LDAP often returns objectSid and objectGUID in binary or base64 form. We convert them when correlating LDAP output with BloodHound, Impacket, PowerView, event logs, and access-control entries.
export DC=10.10.10.200
export BASE='DC=ootw,DC=local'
export DOMAIN=ootw.local
export USER='student'
export PASS='student'
Request SID and GUID:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(sAMAccountName=student)' sAMAccountName objectSid objectGUID
Dump binary attributes to files:
mkdir sid-dump
ldapsearch -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" -tt -T sid-dump '(sAMAccountName=student)' objectSid objectGUID
Decode a base64 SID blob:
echo 'AQUAAAAAAAUVAAAA876dXxGyDj7Cbw6tagQAAA==' | base64 -d | xxd -p -c 256
Parse SID hex:
hexs = input("SID hex: ")
hexs = "".join(c for c in hexs if c.lower() in "0123456789abcdef")
b = bytes.fromhex(hexs)
rev = b[0]
subc = b[1]
ident = int.from_bytes(b[2:8], "big")
subs = [str(int.from_bytes(b[8 + 4*i:12 + 4*i], "little")) for i in range(subc)]
print(f"S-{rev}-{ident}" + "".join("-" + s for s in subs))
Look up SIDs from a DC with Impacket:
lookupsid.py $DOMAIN/$USER:"$PASS"@$DC
lookupsid.py $DOMAIN/$USER:"$PASS"@$DC > sids.txt
grep SidTypeUser sids.txt | awk -F'\\\\' '{ split($2,a," "); print a[1] }' > users.txt
PowerShell:
Get-ADUser student -Properties objectSid,objectGUID | Select-Object SamAccountName,ObjectSid,ObjectGUID