epdump is a Microsoft command-line utility found in the Microsoft Windows Resource Kit. Example 10-1 uses epdump to query the RPC endpoint mapper running on 192.168.189.1 (through TCP port 135).

C:> epdump 192.168.189.1
binding is 'ncacn_ip_tcp:192.168.189.1'
int 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0
  binding 00000000-000000000000@ncadg_ip_udp:192.168.0.1[1028]
  annot 'Messenger Service'
int 1ff70682-0a51-30e8-076d-740be8cee98b v1.0
  binding 00000000-000000000000@ncalrpc:[LRPC00000284.00000001]
  annot ''
int 1ff70682-0a51-30e8-076d-740be8cee98b v1.0
  binding 00000000-000000000000@ncacn_ip_tcp:62.232.8.1[1025]
  annot ''
int 1ff70682-0a51-30e8-076d-740be8cee98b v1.0
  binding 00000000-000000000000@ncacn_ip_tcp:192.168.170.1[1025]
  annot ''
int 1ff70682-0a51-30e8-076d-740be8cee98b v1.0
  binding 00000000-000000000000@ncacn_ip_tcp:192.168.189.1[1025]
  annot ''
int 1ff70682-0a51-30e8-076d-740be8cee98b v1.0
  binding 00000000-000000000000@ncacn_ip_tcp:192.168.0.1[1025]
  annot ''
int 378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0
  binding 00000000-000000000000@ncalrpc:[LRPC00000284.00000001]
  annot ''
int 378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0
  binding 00000000-000000000000@ncacn_ip_tcp:62.232.8.1[1025]
  annot ''
int 378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0
  binding 00000000-000000000000@ncacn_ip_tcp:192.168.170.1[1025]
  annot ''
int 378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0
  binding 00000000-000000000000@ncacn_ip_tcp:192.168.189.1[1025]
  annot ''
int 378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0
  binding 00000000-000000000000@ncacn_ip_tcp:192.168.0.1[1025]
  annot ''
int 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0
  binding 00000000-000000000000@ncalrpc:[ntsvcs]
  annot 'Messenger Service'
int 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0
  binding 00000000-000000000000@ncacn_np:\\WEBSERV[\PIPE\ntsvcs]
  annot 'Messenger Service'
int 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0
  binding 00000000-000000000000@ncacn_np:\\WEBSERV[\PIPE\scerpc]
  annot 'Messenger Service'
int 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0
  binding 00000000-000000000000@ncalrpc:[DNSResolver]
  annot 'Messenger Service'
int 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0
  binding 00000000-000000000000@ncadg_ip_udp:62.232.8.1[1028]
  annot 'Messenger Service'
int 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0
  binding 00000000-000000000000@ncadg_ip_udp:192.168.170.1[1028]
  annot 'Messenger Service'
int 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0
  binding 00000000-000000000000@ncadg_ip_udp:192.168.189.1[1028]
  annot 'Messenger Service'
no more entries

The responses to this query show that the NetBIOS name of the host is WEBSERV, and there are four network interfaces with the following IP addresses:

Analysis of the RPC services that are running reveals that the Messenger Service is accessible through UDP port 1028, along with two named pipes: PIPE tsvcs and PIPEscerpc. Named pipes are accessible through SMB upon authenticating with the NetBIOS session or CIFS services.

Servers running Microsoft Exchange return many details of subsystems that are run as RPC services, and so hundreds of results are returned when using tools such as epdump and rpcdump. The useful information includes details of internal network interfaces and RPC services running on high dynamic ports, which you can use to clarify port scan results.

Many of the RPC services listed through epdump don’t have a plaintext annotation (as the Messenger service does in Example 10-1). An example of an accessible RPC service listed without annotation is as follows:

   annot ''
int 1ff70682-0a51-30e8-076d-740be8cee98b v1.0
   binding 00000000-000000000000@ncacn_ip_tcp:192.168.189.1[1025]

From this information you can see that this is an RPC endpoint accessible through TCP port 1025 on 192.168.189.1, but there is only a 128-bit hex string to identify the service. This string is known as the interface ID (IFID) value.

Todd Sabin wrote two Windows utilities (rpcdump and ifids), used to query the RPC endpoint mapper using specific protocol sequences and to query specific RPC endpoints directly. The rpcdump tool can enumerate RPC service information through various protocol sequences. Its usage is as follows:

            rpcdump [-v] [-p protseq] target

One of four protocol sequences can be used to access the RPC endpoint mapper, as follows:

The -v option enables verbosity so that rpcdump will enumerate all registered RPC interfaces. The -p option allows you to specify a particular protocol sequence to use for talking to the endpoint mapper. If none is specified, rpcdump tries all four protocol sequences.

rpcdump can be run much like epdump from the command line to dump details of network interfaces, IP addresses, and RPC servers. Example 10-2 shows rpcdump running to list all registered RPC endpoints through TCP port 135.

D:
pctools> rpcdump 192.168.189.1
IfId: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc version 1.0
Annotation: Messenger Service
UUID: 00000000-0000-0000-0000-000000000000
Binding: ncadg_ip_udp:192.168.189.1[1028]

IfId: 1ff70682-0a51-30e8-076d-740be8cee98b version 1.0
Annotation:
UUID: 00000000-0000-0000-0000-000000000000
Binding: ncalrpc:[LRPC00000290.00000001]

IfId: 1ff70682-0a51-30e8-076d-740be8cee98b version 1.0
Annotation:
UUID: 00000000-0000-0000-0000-000000000000
Binding: ncacn_ip_tcp:192.168.0.1[1025]

Using the verbose flag, you can walk and enumerate all IFID values for each registered endpoint. First, port 135 is queried, followed by each registered endpoint (UDP port 1028, TCP port 1025, etc.). Example 10-3 shows rpcdump used in this way to fully list all registered RPC endpoints and interfaces.

D:
pctools> rpcdump -v 192.168.189.1
IfId: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc version 1.0
Annotation: Messenger Service
UUID: 00000000-0000-0000-0000-000000000000
Binding: ncadg_ip_udp:192.168.189.1[1028]
RpcMgmtInqIfIds succeeded
Interfaces: 16
  367abb81-9844-35f1-ad32-98f038001003 v2.0
  93149ca2-973b-11d1-8c39-00c04fb984f9 v0.0
  82273fdc-e32a-18c3-3f78-827929dc23ea v0.0
  65a93890-fab9-43a3-b2a5-1e330ac28f11 v2.0
  8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0
  6bffd098-a112-3610-9833-46c3f87e345a v1.0
  8d0ffe72-d252-11d0-bf8f-00c04fd9126b v1.0
  c9378ff1-16f7-11d0-a0b2-00aa0061426a v1.0
  0d72a7d4-6148-11d1-b4aa-00c04fb66ea0 v1.0
  4b324fc8-1670-01d3-1278-5a47bf6ee188 v3.0
  300f3532-38cc-11d0-a3f0-0020af6b0add v1.2
  6bffd098-a112-3610-9833-012892020162 v0.0
  17fdd703-1827-4e34-79d4-24a55c53bb37 v1.0
  5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0
  3ba0ffc0-93fc-11d0-a4ec-00a0c9062910 v1.0
  8c7daf44-b6dc-11d1-9a4c-0020af6e7c57 v1.0

IfId: 1ff70682-0a51-30e8-076d-740be8cee98b version 1.0
Annotation:
UUID: 00000000-0000-0000-0000-000000000000
Binding: ncalrpc:[LRPC00000290.00000001]

IfId: 1ff70682-0a51-30e8-076d-740be8cee98b version 1.0
Annotation:
UUID: 00000000-0000-0000-0000-000000000000
Binding: ncacn_ip_tcp:192.168.0.1[1025]
RpcMgmtInqIfIds succeeded
Interfaces: 2
  1ff70682-0a51-30e8-076d-740be8cee98b v1.0
  378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0

If you can’t connect to the portmapper through TCP port 135, use UDP port 135 to enumerate registered RPC endpoints with the -p ncadg_ip_udp option, shown in Example 10-4.

D:
pctools> rpcdump -p ncadg_ip_udp 192.168.189.1
IfId: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc version 1.0
Annotation: Messenger Service
UUID: 00000000-0000-0000-0000-000000000000
Binding: ncadg_ip_udp:192.168.189.1[1028]

IfId: 1ff70682-0a51-30e8-076d-740be8cee98b version 1.0
Annotation:
UUID: 00000000-0000-0000-0000-000000000000
Binding: ncalrpc:[LRPC00000290.00000001]

IfId: 1ff70682-0a51-30e8-076d-740be8cee98b version 1.0
Annotation:
UUID: 00000000-0000-0000-0000-000000000000
Binding: ncacn_ip_tcp:192.168.0.1[1025]

The ifids utility queries specific RPC endpoints (such as UDP 1029 or TCP 1025) to identify accessible services. A practical application of the ifids utility is to enumerate RPC services running on high ports when the RPC portmapper service isn’t accessible.

The ifids usage is:

            ifids [-p protseq] [-e endpoint]target

The -p option specifies which protocol sequence to use when talking to the server, and the -e option specifies which port to connect to. In Example 10-5, I use ifids to connect to TCP port 1025 and list the accessible interfaces.

D:
pctools> ifids -p ncacn_ip_tcp -e 1025 192.168.189.1
Interfaces: 2
  1ff70682-0a51-30e8-076d-740be8cee98b v1.0
  378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0

By referring to the list of known IFID values, you can see that these two interfaces are Microsoft Task Scheduler (mstask.exe) listeners. Example 10-6 shows how to use the ifids tool to enumerate the IFID values of RPC services accessible through UDP port 1028.

D:
pctools> ifids -p ncadg_ip_udp -e 1028 192.168.189.1
Interfaces: 16
  367abb81-9844-35f1-ad32-98f038001003 v2.0
  93149ca2-973b-11d1-8c39-00c04fb984f9 v0.0
  82273fdc-e32a-18c3-3f78-827929dc23ea v0.0
  65a93890-fab9-43a3-b2a5-1e330ac28f11 v2.0
  8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0
  6bffd098-a112-3610-9833-46c3f87e345a v1.0
  8d0ffe72-d252-11d0-bf8f-00c04fd9126b v1.0
  c9378ff1-16f7-11d0-a0b2-00aa0061426a v1.0
  0d72a7d4-6148-11d1-b4aa-00c04fb66ea0 v1.0
  4b324fc8-1670-01d3-1278-5a47bf6ee188 v3.0
  300f3532-38cc-11d0-a3f0-0020af6b0add v1.2
  6bffd098-a112-3610-9833-012892020162 v0.0
  17fdd703-1827-4e34-79d4-24a55c53bb37 v1.0
  5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0
  3ba0ffc0-93fc-11d0-a4ec-00a0c9062910 v1.0
  8c7daf44-b6dc-11d1-9a4c-0020af6e7c57 v1.0

Urity (http://www.securityfriday.com) wrote a graphical Windows version of the rpcdump tool called RpcScan. In the same way rpcdump -v works, RpcScan queries each registered RPC endpoint and enumerates all the IFID values. Urity spent time researching IFID values and idiosyncrasies, referencing them in the RpcScan output. Figure 10-1 shows the tool in use against 192.168.189.1.

Figure 10-1. RpcScan graphically displays IFID values and references

A number of remotely exploitable RPC interface issues have been publicized over recent years, as listed in Table 10-3.

The walksam utility (found in Todd Sabin’s rpctools package) queries the SAMR named pipe interface (pipesamr) to glean user information. Example 10-7 shows walksam being used across a local Windows network to walk the SAMR interface of 192.168.1.1.

D:
pctools> walksam 192.168.1.1
rid 500: user Administrator
Userid: Administrator
Description: Built-in account for administering the computer/domain
Last Logon:  8/12/2003 19:16:44.375
Last Logoff:  never
Last Passwd Change:  8/13/2002 18:43:52.468
Acct. Expires:  never
Allowed Passwd Change:  8/13/2002 18:43:52.468
Rid: 500
Primary Group Rid: 513
Flags: 0x210
Fields Present: 0xffffff
Bad Password Count: 0
Num Logons: 101

rid 501: user Guest
Userid: Guest
Description: Built-in account for guest access to the computer/domain
Last Logon:  never
Last Logoff:  never
Last Passwd Change:  never
Acct. Expires:  never
Allowed Passwd Change:  never
Rid: 501
Primary Group Rid: 513
Flags: 0x215
Fields Present: 0xffffff
Bad Password Count: 0
Num Logons: 0

The walksam utility also supports additional protocol sequences used by Windows 2000 Domain Controllers. The SAMR interface must first be found (IFID 12345778-1234-abcd-ef00-0123456789ac) using rpcdump or a similar tool to list all the registered endpoints; it’s then accessed using walksam with the correct protocol sequence (over named pipes, TCP, UDP, or HTTP).

Example 10-8 shows walksam in use against a Windows 2000 domain controller running a SAMR interface through the ncacn_ip_tcp endpoint at TCP port 1028.

D:
pctools> walksam -p ncacn_ip_tcp -e 1028 192.168.1.10
rid 500: user Administrator
Userid: Administrator
Description: Built-in account for administering the computer/domain
Last Logon:  8/6/2003 11:42:12.725
Last Logoff:  never
Last Passwd Change:  2/11/2003 09:12:50.002
Acct. Expires:  never
Allowed Passwd Change:  2/11/2003 09:12:50.002
Rid: 500
Primary Group Rid: 513
Flags: 0x210
Fields Present: 0xffffff
Bad Password Count: 0
Num Logons: 101

rpcclient (part of the Unix Samba package from http://www.samba.org) can be used to interact with RPC service endpoints across SMB and named pipes (accessible through the NetBIOS session and CIFS services). The tool has an extraordinary number of features and usage options—far too many to list here. Before using the rpcclient tool, I recommend that you review http://www.samba-tng.org/docs/tng/htmldocs/rpcclient.8.html. Table 10-4 lists the useful SAMR and LSARPC interface commands that can be issued through the rpcclient utility upon establishing an SMB session.

By default, Windows systems and Windows 2003 domain controllers allow anonymous (null session) access to SMB, so these interfaces can be queried in this way. If null session access to SMB is not permitted, a valid username and password must be provided to access the LSARPC and SAMR interfaces.

Example 10-9 shows rpcclient in use against a remote system at 192.168.0.25 to perform RID cycling and enumerate users through the LSARPC named pipe (pipelsarpc). In this example we first look up the full SID value of the chris account, and then increment the RID value (1001 through to 1007) to enumerate the other user accounts through the LSARPC interface.

$ rpcclient -I 192.168.0.25 -U=chris%password WEBSERV
rpcclient> lookupnames chris
chris S-1-5-21-1177238915-1563985344-1957994488-1003 (User: 1)
rpcclient> lookupsids S-1-5-21-1177238915-1563985344-1957994488-1001
S-1-5-21-1177238915-1563985344-1957994488-1001 WEBSERVIUSR_WEBSERV
rpcclient> lookupsids S-1-5-21-1177238915-1563985344-1957994488-1002
S-1-5-21-1177238915-1563985344-1957994488-1002 WEBSERVIWAM_WEBSERV
rpcclient> lookupsids S-1-5-21-1177238915-1563985344-1957994488-1003
S-1-5-21-1177238915-1563985344-1957994488-1003 WEBSERVchris
rpcclient> lookupsids S-1-5-21-1177238915-1563985344-1957994488-1004
S-1-5-21-1177238915-1563985344-1957994488-1004 WEBSERVdonald
rpcclient> lookupsids S-1-5-21-1177238915-1563985344-1957994488-1005
S-1-5-21-1177238915-1563985344-1957994488-1005 WEBSERV	est
rpcclient> lookupsids S-1-5-21-1177238915-1563985344-1957994488-1006
S-1-5-21-1177238915-1563985344-1957994488-1006 WEBSERVdaffy
rpcclient> lookupsids S-1-5-21-1177238915-1563985344-1957994488-1007
result was NT_STATUS_NONE_MAPPED
rpcclient>

Alternatively, you can use the enumdomusers command to simply list all users through a forward lookup (this technique will not work if RestrictAnonymous=1, and RID cycling must be used), as shown in Example 10-10.

rpcclient> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[chris] rid:[0x3eb]
user:[daffy] rid:[0x3ee]
user:[donald] rid:[0x3ec]
user:[Guest] rid:[0x1f5]
user:[IUSR_WEBSERV] rid:[0x3e9]
user:[IWAM_WEBSERV] rid:[0x3ea]
user:[test] rid:[0x3ed]
user:[TsInternetUser] rid:[0x3e8]

The rpcclient tool is extremely powerful and versatile; it allows user accounts to be created remotely and privileges to be elevated. However, this functionality requires a valid username and password combination, often necessitating the use of brute force.

Jean-Baptiste Marchand posted an advisory to BugTraq on July 7, 2005 (http://marc.info/?l=bugtraq&m=112076409813099&w=2), describing a flaw within Windows 2003 SP1, Windows XP SP2, Windows 2000 SP4, and Windows NT 4.0 systems, allowing for an anonymous SMB null session to be established with NetBIOS and CIFS services, which in turn can be used to anonymously access RPC server named pipe interfaces, as follows:

These service endpoints can be queried using tools such as Samba rpcclient, allowing remote unauthenticated attackers to enumerate users and groups, view running services, and view the server event logs under Windows NT 4.0 and Windows 2000 SP4 in their default configurations. Windows Server 2003 Active Directory and domain controllers are also susceptible, although Windows XP SP2 is largely shielded from these vulnerabilities.

John-Baptiste Marchand’s presentation covering null sessions and RPC named pipes is available from http://www.hsc.fr/ressources/presentations/null_sessions/. He discusses hardcoded named pipes that are present in Windows XP SP1 and earlier, and how these can be used to proxy RPC queries and commands to other RPC named pipe interfaces that run within the same service instance server-side.

Jordan Ritter’s enum utility is a Windows command-line tool that can extensively query the NetBIOS session service. The tool can list usernames, password policy, shares, and details of other hosts including domain controllers. Example 10-14 shows the enum usage information.

D:enum> enum
usage:  enum  [switches]  [hostname|ip]
  -U:  get userlist
  -M:  get machine list
  -N:  get namelist dump (different from -U|-M)
  -S:  get sharelist
  -P:  get password policy information
  -G:  get group and member list
  -L:  get LSA policy information
  -D:  dictionary crack, needs -u and -f
  -d:  be detailed, applies to -U and -S
  -c:  don't cancel sessions
  -u:  specify username to use (default "")
  -p:  specify password to use (default "")
  -f:  specify dictfile to use (wants -D)

By default, the tool attempts to use an anonymous null session to enumerate system information. You can, however, specify a username and password from the command line or even use the -D flag along with -u and -f <filename> options to perform brute-force grinding of a valid user password against the NetBIOS session service.

Any combination of the query flags can be used within a single command. Example 10-15 shows enum being used to enumerate user, group details, and password policy information.

D:enum> enum -UGP 192.168.189.1
server: 192.168.189.1
setting up session... success.
password policy:
  min length: none
  min age: none
  max age: 42 days
  lockout threshold: none
  lockout duration: 30 mins
  lockout reset: 30 mins
getting user list (pass 1, index 0)... success, got 5.
  __vmware_user__  Administrator  Guest  Mickey  VUSR_OSG-SERV
Group: Administrators
OSG-SERVAdministrator
Group: Backup Operators
Group: Guests
OSG-SERVGuest
Group: Power Users
OSG-SERVMickey
Group: Replicator
Group: Users
NT AUTHORITYINTERACTIVE
NT AUTHORITYAuthenticated Users
Group: __vmware__
OSG-SERV\__vmware_user__
cleaning up... success.

These details show that the out-of-box default Windows 2000 password policy is in place (no minimum password length or account lockout threshold). Along with the standard Administrator, Guest, and other system accounts, the user Mickey is also present.

The winfo utility gives a good overview of the target Windows host through a null session. It collects information that enum doesn’t, including domain trust details and currently logged-in users. Example 10-16 demonstrates winfo in use.

D:> winfo 192.168.189.1
Winfo 2.0 - copyright (c) 1999-2003, Arne Vidstrom
          - http://www.ntsecurity.nu/toolbox/winfo/

SYSTEM INFORMATION:
 - OS version: 5.0

DOMAIN INFORMATION:
 - Primary domain (legacy): OSG-WHQ
 - Account domain: OSG-SERV
 - Primary domain: OSG-WHQ
 - DNS name for primary domain:
 - Forest DNS name for primary domain:

PASSWORD POLICY:
 - Time between end of logon time and forced logoff: No forced logoff
 - Maximum password age: 42 days
 - Minimum password age: 0 days
 - Password history length: 0 passwords
 - Minimum password length: 0 characters

LOCOUT POLICY:
 - Lockout duration: 30 minutes
 - Reset lockout counter after 30 minutes
 - Lockout threshold: 0

SESSIONS:
 - Computer: OSG-SERV
 - User: ADMINISTRATOR

LOGGED IN USERS:

 * __vmware_user__
 * Administrator

USER ACCOUNTS:

 * Administrator
   (This account is the built-in administrator account)
 * Guest
   (This account is the built-in guest account)
 * mickey
 * VUSR_OSG-SERV
 * __vmware_user__

WORKSTATION TRUST ACCOUNTS:
INTERDOMAIN TRUST ACCOUNTS:
SERVER TRUST ACCOUNTS:

SHARES:

 * IPC$
    - Type: Unknown
    - Remark: Remote IPC
 * D$
    - Type: Special share reserved for IPC or administrative share
    - Remark: Default share
 * ADMIN$
    - Type: Special share reserved for IPC or administrative share
    - Remark: Remote Admin
 * C$
    - Type: Special share reserved for IPC or administrative share
    - Remark: Default share

By default, Windows systems share all drive letters in use, such as C$ and D$ in the examples here. These shares can be accessed remotely upon authenticating, allowing you to upload and download data. The other shares shown here (IPC$ and ADMIN$) are for administrative purposes, such as installing software and managing processes running on the host remotely.

GetAcct is a useful tool that allows you to perform reverse-lookups for Windows server RID values to get user account names (also known as RID cycling). Standard enumeration tools such as enum and winfo simply use forward-lookup techniques to dump the user list, which administrators can protect against by setting RestrictAnonymous=1 within the system registry (discussed later under the "Windows Networking Services Countermeasures" section).

Windows NT 4.0 hosts can only set RestrictAnonymous=1, and are thus susceptible to RID cycling. Windows 2000 hosts have extended anonymous access protection which can be set with RestrictAnonymous=2, preventing RID cycling from being effective. Figure 10-3 shows GetAcct in action against a Windows 2000 host at 192.168.189.1.

Figure 10-3. GetAcct performs RID cycling to enumerate users

The smbdumpusers utility is a highly versatile Windows NT user enumeration tool that can query SMB through both NetBIOS session (TCP 139) and CIFS (TCP 445) services. A second useful feature is the way the utility can enumerate users through a direct dump that works with RestrictAnonymous=0, but also using the RID cycling technique that can evade RestrictAnonymous=1 settings by attempting to reverse each ID value to a username. Example 10-20 shows the usage and command-line options for smbdumpusers.

D:smb-at> smbdumpusers

 SMB - DumpUsers V1.0.4 by ([email protected])
 -------------------------------------------------------------------
 usage: smbdumpusers -i <ipaddress|ipfile> [options]

         -i*     IP or <filename> of server[s] to bruteforce
         -m      Specify which mode
                     1 Dumpusers (Works with restrictanonymous=0)
                     2 SidToUser (Works with restrictanonymous=0|1)
         -f      Filter output
                     0 Default (Filter Machine Accounts)
                     1 Show All
         -e      Amount of sids to enumerate
         -E      Amount of sid mismatches before aborting mode 2
         -n      Start at SID
         -s      Name of the server to bruteforce
         -r      Report to <ip>.txt
         -t      timeout for connect (default 300ms)
         -v      Be verbose
         -P      Protocol version
                     0 - Netbios Mode
                     1 - Windows 2000 Native Mode

Example 10-21 shows the smbdumpusers tool dumping user information via RID cycling (as with GetAcct in Figure 10-3) through CIFS.

D:smb-at> smbdumpusers -i 192.168.189.1 -m 2 -P1
500-Administrator
501-Guest
513-None
1000-__vmware__
1001-__vmware_user__
1002-VUSR_OSG-SERV
1003-mickey