Hi everybody and welcome to part five and going into a little deeper mini module.
So in this particular video we're to be talking about the Windows side.
So what is this Heidi aside as a security identifier.
It is a unique string that is given out to every user in every group.
Now this is done for permissions and access restrictions and access granting so the the I.D. here the
security I.D. will never change for that user.
So this is how you're able to change the user name in the group name while not modifying any permissions
because all of the all of the permissions are based around this site.
Now the S.A.T. is kept inside of the access token which will go over in another video but just know
that it resides inside of an access token.
So when that access token is passed around the windows api calls.
So when it's creating a window user access control whatever the case might be the s idea is also verified
to make sure that it's the same user.
Now there are things such as impersonation tokens which again will go over and the tokens video that
will allow you to kind of bypass that restriction.
But in a general sense that the user much must match the user I.D. So this particular I.D. is a mutable
which means it will never ever change.
You can't change it without doing some weird stupid stuff.
And if you do that you will break it everywhere else it doesn't just propagate to all of the security
restrictions you've got in place.
So when we were looking at the in the permissions video and we were looking at the user's permissions
and that window when it was showing the user name in reality that's just for us to identify a little
easier than having an S I.D. number.
But behind the scenes that is actually an S I.D. number.
So if you delete the user let's say you set permissions on a few things and you delete the user you
won't see the user name anymore.
You'll just see an S.A.T..
Just keep that in mind in case you see a number that looks just like that.
So again what is it.
I said You look like this is the general format of an essay.
So in the first part in between in the first dash right here we have an S which is just to identify
it's an essay.
Now the one is the version of us I.D. that will never change it's always a one.
There's a few restrictions around when it would change but for a user or group it generally ends up
being a one.
Now the security identifying authority is a five.
We don't need to go too much into that it tends to stay at five and the next part from 21 all the way
to the end this 42 or the last dashes is the domain or local identifier for the system.
So in this case really a window service or we're gonna be using the local identifier for that machine.
Now that will change every single time you have a new machine.
However the important piece is that in part which is the relative I.D..
So in my case it's 500 which will go over y in a second.
So if you look at the screenshot at the bottom who am I slash all from the command line in Windows will
give you your SS I.D. for your user in my particular case.
This is the one that I have and it will and it will be different for every user on every system.
Now what is an RFID.
It is a relative I.D. the local administrative user is always five hundred.
The guest account is always 5 0 1 and users start at 1000 and will go up by one for each user.
So when you're in an engagement and you're and you find yourself messing about with asides but not user
names if you're seeing it as idea of five hundred that you can let's say impersonate or you are looking
you're looking to drop hashes for a user and you see S.A.T. would do it with the relative idea.
Five hundred you can immediately assume that that is a local admin account on that machine.
If it's a five a one you know you can relatively ignore it because it's the guest account which has
been disabled on most systems.
Now again a thousand plus can go as far as 19 20 30 thousand if you have that many users it can just
keep going.
There's no user started a thousand and so there are a few universal ideas.
These are common across all windows installs so you can if you see these first sets first parts of the
S.A.T. you can assume that it's a universal one.
So s 1 0 0 is null.
So when a user in Windows freaks out and it can't identify a user for whatever reason it's going to
assign this side I.D. by default.
This also happens when a group has 0 members in it as well.
Just keep that in mind especially if you're looking at groups based on an S.A.T. now a world S.A.T..
For a group that has every user for that system in it which will be an S one one zero.
You won't find that nearly as common.
But just know that it is good it exists and the local s ideas s 1 2 0 so local S.A.T. is assigned to
a user using a local terminal.
So this could be let's say telnet or a few other things but just note that these are there you might
see them occasionally from time to time but in a general sense just know what an S.A.T. is.
You can play around with it by running this command on the windows machine that we built.
You can see that yours is different.
Now we'll go a little bit more into where these things are stored and passed in the tokens video but
just understand that aside these exist you don't have to always remember the full structure of the string.
Just remember that last bit.
This part right here is important.
Knowing what the local admin account is always set at guest account and then where users start.
That way you can always helped identify things quickly without having to look up where the s idea is
coming from.