GCIH · Question #771
What is the Linux administrator doing with the commands below? $ rpcclient -U fezzik florin rpcclient $> enumdomusers
The correct answer is C. Finding locally defined users on the target server. The 'enumdomusers' command in rpcclient lists user accounts defined on the target host, which in a workgroup or local context means locally defined users.
Question
What is the Linux administrator doing with the commands below? $ rpcclient -U fezzik florin rpcclient $> enumdomusers
Options
- AResolving SIDs to usernames on the target server
- BDisplaying the rights associated with a SID on the target server
- CFinding locally defined users on the target server
- DEnumerating the SIDs of all users defined locally on the target server
How the community answered
(25 responses)- A4% (1)
- B12% (3)
- C80% (20)
- D4% (1)
Why each option
The 'enumdomusers' command in rpcclient lists user accounts defined on the target host, which in a workgroup or local context means locally defined users.
Resolving SIDs to usernames is performed by the 'lookupsids' command in rpcclient, not 'enumdomusers'.
Displaying rights associated with a SID is performed using 'lsaenumsid' or similar LSA commands, not 'enumdomusers'.
When rpcclient connects to a standalone or workgroup Linux/Samba host (not a domain controller), the 'enumdomusers' command queries the local user database and returns the locally defined user accounts. In this scenario 'florin' is a standalone Samba host, so the result set reflects local users rather than domain-wide accounts. This is a common reconnaissance technique for enumerating valid usernames on a target system.
Enumerating SIDs of local users would use 'lookupnames' or 'lsaenumsid', whereas 'enumdomusers' returns usernames and RIDs, not raw SID enumeration.
Concept tested: rpcclient enumdomusers for local user enumeration
Source: https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html
Topics
Community Discussion
No community discussion yet for this question.