1

Is there a way to remotely retrieve the UID of a user via a Samba share?

I can get the user list with:

rpcclient -W 'WORKGROUP' -c querydispinfo -U''%'' '192.168.21.129' 2>&1

index: 0xa RID: 0x4c0 acb: 0x00000011 Account: foo Name: foo    Desc: (null)

Or I can cycle the RIDs with

rpcclient -W 'WORKGROUP' -c enumdomusers -U''%'' '192.168.21.129' 2>&1

user:[foo] rid:[0x4c0]

Or I can try and query the user directly:

rpcclient -W 'WORKGROUP' -U''%'' '192.168.21.129' -c 'lookupnames foo' 2>&1
foo S-1-5-21-1042354039-2475377354-766472396-1216 (User: 1)

However, I can't see a way to retrieve the user's UID.

Is this possible, short of finding an anonymous share that allows access to /etc/passwd?

Note that am asking from the point of view of an attacker enumerating the network and its users, not from the point of view of someone setting up a home Samba network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.