A cross-platform tool to find traces of old SIDs remaining in LDAP objects of the Active Directory.
- Only requires a low privileges domain user account
- Searches for old SIDs in
nTSecurityDescriptorandmsDS-AllowedToActOnBehalfOfOtherIdentityattributes - Validates SIDs against a comprehensive map of well-known SIDs and SIDs from the domain
- Supports both LDAP and LDAPS connections
In order to find the old SIDs that might remain in the security descriptors and structures of the objects in the domain, you can use the following command:
./FindOldSIDTraces --dc-ip "<domain_controller_ip>" --domain "<domain>" --username "<username>" --password "<password>" You will get the following output:
$ ./FindOldSIDTraces -h
FindOldSIDTraces - by Remi GASCOU (Podalirius) @ TheManticoreProject - v1.0.0
Usage: FindOldSIDTraces --domain <string> --username <string> [--password <string>] [--hashes <string>] [--quiet] [--debug] [--no-colors] [--attribute <string>] [--output-file <string>] --dc-ip <string> [--ldap-port <tcp port>] [--use-ldaps]
Authentication:
-d, --domain <string> Active Directory domain to authenticate to.
-u, --username <string> User to authenticate as.
-p, --password <string> Password to authenticate with. (default: "")
-H, --hashes <string> NT/LM hashes, format is LMhash:NThash. (default: "")
Configuration:
-q, --quiet Show no information at all. (default: false)
--debug Debug mode. (default: false)
-nc, --no-colors No colors mode. (default: false)
-a, --attribute <string> Output attribute. (default: "distinguishedName")
-o, --output-file <string> Output file to write results to. (default: "")
LDAP Connection Settings:
-dc, --dc-ip <string> IP Address of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted, it will use the domain part (FQDN) specified in the identity parameter.
-lp, --ldap-port <tcp port> Port number to connect to LDAP server. (default: 389)
-L, --use-ldaps Use LDAPS instead of LDAP. (default: false)
Pull requests are welcome. Feel free to open an issue if you want to add other features.
- Remi GASCOU (Podalirius) for the creation of the FindOldSIDTraces.