User-to-SID - Empire Module

This page contains detailed information about how to use the powershell/management/user_to_sid Empire module. For list of all Empire modules, visit the Empire Module Library.

Module Overview

---

Name: User-to-SID
Module: powershell/management/user_to_sid
Source code [1]: empire/server/modules/powershell/management/user_to_sid.yaml
Source code [2]: empire/server/modules/powershell/management/user_to_sid.py
MITRE ATT&CK: T1098
Language: PowerShell
Needs admin: No
OPSEC safe: Yes
Background: No

The user_to_sid module converts a specified domain\user to a domain sid.

This module runs in a foreground and is OPSEC unsafe as it writes on the disk and therefore could be detected by AV/EDR running on the target system.

Note that the user_to_sid module does not need administrative privileges to work properly which means that a normal user can run this module.

Required Module Options

---

This is a list of options that are required by the user_to_sid module:

Agent
Agent to run module on.

Domain
Domain name for translation.

User
Username for translation.

User_to_sid Example Usage

---

Here's an example of how to use the user_to_sid module in the Empire client console:

[+] New agent Y4LHEV83 checked in
[*] Sending agent (stage 2) to Y4LHEV83 at 192.168.204.135
(empire usestager/windows/ducky) > usemodule powershell/management/user_to_sid

 Author       @harmj0y                                          
 Background   False                                             
 Description  Converts a specified domain\user to a domain sid. 
 Language     powershell                                        
 Name         powershell/management/user_to_sid                 
 NeedsAdmin   False                                             
 OpsecSafe    True                                              
 Techniques   http://attack.mitre.org/techniques/T1098          


,Record Options--,----------,------------------------------,
| Name   | Value | Required | Description                  |
|--------|-------|----------|------------------------------|
| Agent  |       | True     | Agent to run module on.      |
|--------|-------|----------|------------------------------|
| Domain |       | True     | Domain name for translation. |
|--------|-------|----------|------------------------------|
| User   |       | True     | Username for translation.    |
'--------'-------'----------'------------------------------'

(Empire: usemodule/powershell/management/user_to_sid) > set Agent Y4LHEV83
[*] Set Agent to Y4LHEV83
(Empire: usemodule/powershell/management/user_to_sid) > set Domain local.corp
[*] Set Domain to local.corp
(Empire: usemodule/powershell/management/user_to_sid) > set User user
[*] Set User to user
(Empire: usemodule/powershell/management/user_to_sid) > execute
[*] Tasked Y4LHEV83 to run Task 1
...

Now wait for the results to come.

Author

---

• @harmj0y

References

---

• https://github.com/BC-SECURITY/Empire/tree/master/empire/server/modules/powershell/management/user_to_sid.yaml
• https://github.com/BC-SECURITY/Empire/tree/master/empire/server/modules/powershell/management/user_to_sid.py
• http://attack.mitre.org/techniques/T1098

See Also

---

Check also the following modules related to this module:

• powershell/situational_awareness/network/powerview/user_hunter
• powershell/management/timestomp
• powershell/management/spawnas
• powershell/management/zipfolder
• powershell/management/switch_listener
• powershell/management/start-processasuser
• powershell/management/invoke_script
• powershell/management/invoke_sharpchisel
• powershell/management/get_domain_sid
• powershell/management/enable_multi_rdp
• powershell/management/enable_rdp
• powershell/management/reflective_inject
• powershell/management/shinject
• powershell/management/lock
• powershell/management/sid_to_user
• powershell/management/psinject
• powershell/management/spawn
• powershell/management/phant0m
• powershell/management/disable_rdp
• powershell/management/wdigest_downgrade
• powershell/management/runas
• powershell/management/downgrade_account
• powershell/management/vnc
• powershell/management/powercat
• powershell/management/logoff
• powershell/management/invoke_socksproxy
• powershell/management/restart
• powershell/management/honeyhash
• powershell/management/mailraider/get_subfolders
• powershell/management/mailraider/mail_search
• powershell/management/mailraider/send_mail
• powershell/management/mailraider/view_email
• powershell/management/mailraider/search_gal
• powershell/management/mailraider/get_emailitems
• powershell/management/mailraider/disable_security

Version

---

This page has been created based on Empire version 4.1.3 (BC Security Fork).
Visit Empire Module Library for more modules.