利用Python实现目标Windows主机中SID的枚举以及转换为用户名
本代码主要由以下几部分组成:
1.判断出目标主机的回收站的路径(不同版本的回收站路径不一样)
2.通过列出回收站目录的内容得到SID列表,每个SID对应一个用户(可能是系统用户)
3.将SID与用户名进行匹配转换,通过注册表查询实现
import winreg import os import sys class DetectUsername: def __init__(self) -> None: self.recycler_list = ['C:\\Recycler\\','C:\\Recycled\\','C:\\$Recycle.Bin\\'] self.banner() def banner(self): banner = """ ******************************************** **Username Enumeeration TOol y Jason Wong*** ******************************************** """ print(banner) def find_recycler_path(self): try: for recycler_path in self.recycler_list: if os.path.isdir(recycler_path): print("Found",recycler_path) return recycler_path except Exception as e: print(e) sys.exit(0) def find_sid_list(self): recycler_path = self.find_recycler_path() sid_list = os.listdir(recycler_path) # print('list output:', sid_list) return sid_list def sid2username(self,sid): print("Converting SID%s:" % sid) try: key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" + '\\' + sid) value,type = winreg.QueryValueEx(key, 'ProfileImagePath') # print("Value:", value) username = value.split('\\')[-1] print(username) except Exception as e: pass def run(self): sid_list = self.find_sid_list() for sid in sid_list: self.sid2username(sid) if __name__ == "__main__": print("*"*200) detector = DetectUsername() detector.run()
STRIVE FOR PROGRESS,NOT FOR PERFECTION