metasploit-gs/documentation/modules/post/windows/gather/resolve_sid.md

Vulnerable Application

This module prints information about a given SID from the perspective of this session.

Verification Steps

1. Start msfconsole
2. Get a session on a Windows host
3. Do: use post/windows/gather/resolve_sid
4. Do: set session [#]
5. Do: run
6. You should receive user SID information

Options

SID

SID to lookup.

SYSTEM_NAME

Where to search. If undefined, first local then trusted DCs.

Scenarios

Windows 2008 SP1 DC

msf6 > use post/windows/gather/resolve_sid
msf6 post(windows/gather/resolve_sid) > set sid S-1-5-32-544
sid => S-1-5-32-544
msf6 post(windows/gather/resolve_sid) > set session 1
session => 1
msf6 post(windows/gather/resolve_sid) > run

[*] SID Type: alias
[*] Name:     Administrators
[*] Domain:   BUILTIN
[*] Post module execution completed