Impacket LookupSID

Enumerate domain SIDs and discover trust relationships via SID brute-forcing

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: impacket-lookupsid
Category: Privilege Escalation / Trust Attacks
Platform: linux
Requires: password
Protocols: SMB

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

impacket-lookupsid '<domain>/<user>:<password>'@<ip>

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

impacket-lookupsid -hashes ':<hash>' '<domain>/<user>'@<ip>

Kerberos Ticket requires Kerberos ticket

impacket-lookupsid -k -no-pass '<domain>/<user>'@<ip>

Examples

impacket-lookupsid 'corp.local/user:password'@192.168.1.100

Tags

impacket lookupsid sid trust enumeration

Inter-Realm Golden Ticket Forge a cross-domain Golden Ticket to escalate from child to parent domain
Impacket goldenPac (MS14-068) Exploit MS14-068 Kerberos privilege escalation to obtain Domain Admin via forged PAC
Impacket raiseChild Escalate from child domain DA to forest root DA via inter-realm Kerberos trust
LDAPSearch Shadow Principals (PAM Trust) Enumerate msDS-ShadowPrincipal objects to identify PAM trust shadow principals
NetExec LDAP Raise Child Escalate from child domain DA to forest root DA via inter-realm Kerberos trust abuse
NetExec SMB NoPAC Check for and exploit the NoPAC (CVE-2021-42278/42287) Kerberos privilege escalation…
NetExec SMB Zerologon Check for Zerologon (CVE-2020-1472) vulnerability — resets DC computer account password…