nt-sid.txt

+---------------------------------------------------------------------------
--+
|Author : NtWaK0
|
|Subject: nt-sid.txt

+---------------------------------------------------------------------------
--+
|Author : NtWaK0
|
|Subject: EVENT VIEWER SPIT OUT THE SID
|
|Date: Sep-3-2000
|
+---------------------------------------------------------------------------
--+

SECURITY ISSUE FOUND WHILE I WAS WRITING SOME PAPER ABOUT NT LOGS
=================================================================

To the one of you who know the SID in NT and the tool "sid2user" that
allow
you to get the SID of the users .

Well I found a way to get the SID even Administrator Remotly if certain
conditions are meet:

1- By default NT logs can be viewed remotly :)
2- If you have Audting Enabled
3- If your policies Block The account after certain failure count.

Now here is what you need to do to get NT Spit out the SID
----------------------------------------------------------

Try to login to the remote box using any exisiting account and the box
you will get a logong failure and in event viewer you will generate an
entry

Logon Failure:
Reason: Unknown user name or bad password
User Name: WaKiNg
Domain: WaK0
Logon Type: 3
Logon Process: KSecDD
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: \\BRAINCELL

If like I said you have a policy that block an account after certain
count
You will you see this entry in your log file.
ser Account Locked Out:
Target Account Name: WaKiNg
Target Account ID: S-1-5-21-431509504-1754822488-1124750213-500
Caller Machine Name: \\BRAINCELL
Caller User Name: SYSTEM
Caller Domain: NT AUTHORITY
Caller Logon ID: (0x0,0x3E7)

So now if you connect to the remote EVENT box using event viewer you will
be able to see the logs and you will see the SID
Target Account ID: S-1-5-21-431509504-1754822488-1124750213-500

I did not do any other research into this cause the objective was not to
find something but it was to write this paper :)


The Full paper about NT logs will be on www.legions.org


============================================================================
===
Cheers,
------|oOo-(NtWaK0)(Telco. Eng. InfoSec Senior, Etc..)-oOo|------
The only secure computer is one that's unplugged, locked in a
safe, and buried 20 feet under the ground in a secret location...
and i'm not even too sure about that one"--Dennis Huges, FBI.
-----------------------------------------------------------------
Live Well Do Good, Accept no limitations --:)