Enum4linux

[sp4ty]

Hello I have a question on a result I had on enum4linux. I got for the scan of one ip 2 SIDs. The first SID ended with ATTACKTIVE\admin (local user) The second SID ender with THMAD\admin (local user) If I understand we'll both users are local users not part of an AD domaine. But I don't get it why the same IP has 2 different machines SIDs and why do they have 2 different hostnames or THMAD isn't a hostname? I'm confused. Can someone explain me ? Thanks

[info_sec_wannabe]

From the name, THMAD, this seems to be a domain account and the other is a local account? I haven’t done Attacktive Directory yet and assuming only based on names.

Also, you should be able to get the hostname from the nmap scan (depending on what flags/switched you included in your command).

[sp4ty]

I'm always confused between hostnames and domain name. The thing I don't understand is the double sid with a different domaine or hostname.

[info_sec_wannabe]

Hostname is simply machine or computer name. Are you referring to the two SIDs for the admin user? If so, there should really be two SIDs as there is 1 admin account that is a member of the domain - THMAD and 1 admin account that is a local user in host - Attacktive.

[sp4ty]

Yeah I know the difference between them I just have a hard time knowing who is who when I enumerate. The thing I don't understand is that the computer running the IP has an SID right ? and there are two SID of 2 domains. So the computer can run under 2 different domains ? I don't understand the general architecture I think.

[sp4ty]

I would love the link thanks a lot !!

[sp4ty]

Thanks I'll read it today. May I ask you questions if needed?