Enumerating Logged-On Users on Remote Systems via Winreg Named Pipe

GetLoggedOnUsersRegistry.cs

using System;
using System.Collections.Generic;
using System.IO.Pipes;
using System.Security.Principal;
using System.Text.RegularExpressions;

/*
Based on the work of Rohan Vazarkar (@cptjesus) and Antonio Cocomazzi (@splinter_code).
RemoteRegistry cannot be DISABLED for this to work.

https://twitter.com/splinter_code/status/1715876413474025704
https://blog.compass-security.com/2022/05/bloodhound-inner-workings-part-3/
https://github.com/BloodHoundAD/SharpHound3/blob/master/SharpHound3/Tasks/LoggedOnTasks.cs#L150
 */

namespace GetLoggedOnUsersRegistry
{
    internal class Program
    {
        static void Main(string[] args)
        {
            string hostname = args.Length > 0 && !string.IsNullOrWhiteSpace(args[0]) ? args[0] : Environment.MachineName;
            Console.WriteLine($"[*] Attempting to enumerate logged on users on {hostname}");

            var users = new Dictionary<string, string>();

            using (var namedPipeClientStream = new NamedPipeClientStream(hostname, "winreg"))
            {
                try
                {
                    namedPipeClientStream.Connect(5000);
                }
                catch
                {
                    return;
                }

                if (!namedPipeClientStream.IsConnected) return;

                Console.WriteLine("[*] Successfully connected to winreg named pipe.\n");

                var reg = Microsoft.Win32.RegistryKey.OpenRemoteBaseKey(Microsoft.Win32.RegistryHive.Users, hostname);
                var sidRegex = new Regex(@"S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$", RegexOptions.Compiled);

                foreach (var subkey in reg.GetSubKeyNames())
                {
                    if (sidRegex.IsMatch(subkey))
                    {
                        var sid = new SecurityIdentifier(subkey);
                        var ntAccount = (NTAccount)sid.Translate(typeof(NTAccount));
                        users.Add(subkey, ntAccount.Value);
                    }
                }
            }

            Console.WriteLine(users.Count == 0 ? "[!] No users found!" : $"[*] Successfully enumerated {users.Count} users!");
            foreach (var user in users)
            {
                Console.WriteLine($"[+] SID: {user.Key}, User: {user.Value}");
            }
        }
    }
}