Is there a way to remotely retrieve the UID of a user via a Samba share?
I can get the user list with:
rpcclient -W 'WORKGROUP' -c querydispinfo -U''%'' '192.168.21.129' 2>&1 index: 0xa RID: 0x4c0 acb: 0x00000011 Account: foo Name: foo Desc: (null)
Or I can cycle the RIDs with
rpcclient -W 'WORKGROUP' -c enumdomusers -U''%'' '192.168.21.129' 2>&1 user:[foo] rid:[0x4c0]
Or I can try and query the user directly:
rpcclient -W 'WORKGROUP' -U''%'' '192.168.21.129' -c 'lookupnames foo' 2>&1 foo S-1-5-21-1042354039-2475377354-766472396-1216 (User: 1)
However, I can't see a way to retrieve the user's UID.
Is this possible, short of finding an anonymous share that allows access to
Note that am asking from the point of view of an attacker enumerating the network and its users, not from the point of view of someone setting up a home Samba network.