@echo off
rem Script by Adrian Puente Z.
rem Powered by Hackarandas www.hackarandas.com
rem Licensed by GNU GPLv3
rem http://www.gnu.org/licenses/gpl-3.0.txt
CLS
ECHO.
ECHO         ..:: H4ckarandas ::..
ECHO   ----- Domain SID Enumerator -----
ECHO.

SET MAXSID=
IF "%1"=="" GOTO NOARGUMENT
IF "%2" == "" ( SET MAXSID=2000 && ECHO [+] Last SID will be defaulted to 2000.) ELSE ( SET MAXSID=%2 && ECHO [+] Last SID will be %MAXSID% )
IF %MAXSID% LSS 501 ECHO [-] Last SID should be higher than 500! && GOTO NOARGUMENT

SET HOST=%1
SET SID=
SET DOMAIN=
SET OUTFILE=
SET OUTUSERS=
SET OUTGROUPS=

ECHO [+] Testing connection to %HOST%
ping -n 3 %HOST% 1>NUL 2>&1 || GOTO ERRORCONN

ECHO [+] Getting Domain SID for %HOST%
dom2sid \\%HOST% | grep Domain > TMP.delme || GOTO ERRORSID

IF NOT EXIST TMP.delme GOTO DAFUQ
grep name TMP.delme | sed "s/.*: //g" | tr -d " " > D || GOTO DAFUQ
grep SID TMP.delme | sed "s/.*-1-//g" | tr "-" " " > S || GOTO DAFUQ
DEL TMP.delme 1>/NUL 2>&1
FOR /F "usebackq delims=" %%i IN (`cat D`) DO SET DOMAIN=%%i && DEL D 1>/NUL 2>&1
FOR /F "usebackq delims=" %%i IN (`cat S`) DO SET SID=%%i && DEL S 1>/NUL 2>&1
ECHO [*] %DOMAIN% - %SID%
ECHO [+] Start Enumeration.

SET OUTFILE=%DOMAIN%ENUMERATION.txt
DEL "%OUTFILE%" > NUL 2>&1
FOR /L %%i IN (500,1,%MAXSID%) DO ECHO -- %%i -- && sid2user.exe \\%HOST% %SID% %%i | tee -a "%OUTFILE%"
ECHO.
ECHO [*] Enumeration file: %OUTFILE%
SET OUTUSERS=%DOMAIN%users.txt
SET OUTGROUPS=%DOMAIN%groups.txt
SET OUTPCS=%DOMAIN%computers.txt
ECHO [+] Parsing Users
grep -B 2 "SidTypeUser"  "%OUTFILE%" | grep "Name is" | grep -v "\$" | sed "s/Name is //g" | sort | uniq > "%OUTUSERS%"
ECHO [*] Created file with users: %OUTUSERS%.
ECHO [+] Parsing Computers
grep -B 2 "SidTypeUser"  "%OUTFILE%" | grep "Name is" | grep "\$"| sed "s/Name is //g" | sort | uniq > "%OUTPCS%"
ECHO [*] Created file with computers: %OUTPCS%.
ECHO [+] Parsing Groups
grep -B 2 "SidTypeGroup"  "%OUTFILE%" | grep "Name is" | sed "s/Name is //g" | sort | uniq > "%OUTGROUPS%"
ECHO [*] Created file with groups: %OUTGROUPS%.
ECHO [+] Done.
GOTO END

:ERRORCONN
ECHO [-] Error connecting to %HOST%
GOTO END

:ERRORSID
ECHO [-] Cannot get Domain SID from %HOST%
GOTO END

:DAFUQ
ECHO [-] Something went wrong!
GOTO END

:NOARGUMENT
ECHO.
ECHO  Usage: %~n0  host [maxsid]
ECHO.
ECHO  Example: %~n0  10.0.0.1 
ECHO           %~n0  10.0.0.1 5000
ECHO.

:END
