ridenum

Rid Enum performs a RID cycling attack to enumerate user accounts on remote Windows servers via null sessions and SID enumeration. This technique exploits the Security Identifier (SID) structure to guess Relative Identifiers (RIDs) for user accounts, typically starting from RID 500 upwards.

The tool first attempts to query the Local Security Authority (LSA) to obtain the base domain SID, then cycles through the specified RID range to identify valid user accounts. After enumeration, if a password file is provided, it automatically attempts to brute force the enumerated accounts.

Use cases include pre-exploitation reconnaissance on domain controllers or Windows servers with null session access enabled, helping identify valid usernames for subsequent password attacks or privilege escalation attempts.

ridenum connects to a remote Windows server using null sessions (unauthenticated SMB connections) to query the Security Account Manager (SAM) database via LSA queries. It first enumerates the base domain SID, then performs SID-to-RID translation for each RID in the specified range (e.g., 500-50000). Valid RIDs correspond to existing user accounts. With a password file, it attempts SMB authentication against discovered usernames using dictionary attacks. Requires python3-pexpect for session handling.