135, 593 - MSRPC

Enumeration

You can query the RPC locator service and individual RPC endpoints to catalog services running over TCP, UDP, HTTP, and SMB (via named pipes).

Each returned IFID value represents an RPC service. See Notable RPC Interfaces.

By default, impacket will try to match them with a list of well known endpoints.

impacket pcdump.py

Dump the list of RPC endpoints.

rpcdump.py 10.0.0.3
Parameters
  • target: [[domain/]username[:password]@]address

  • -port <ports>: Destination port to connect to SMB server. Default: 135.

impacket samrdump.py

List system user accounts, available resource shares and other sensitive information exported through the SAMR (Security Account Manager Remote) interface.

samrdump.py 10.0.0.3
Parameters
  • target: [[domain/]username[:password]@]address

  • -port <ports>: Destination port to connect to SMB server. Default: 445.

msrpc-enum NSE Script

nmap -sV -script msrpc-enum -Pn 10.0.0.3

Query RPC

The rpcclient can be used to interact with individual RPC endpoints via named pipes. By default, Windows systems and Windows 2003 domain controllers allow anonymous (Null Sessions) access to SMB, so these interfaces can be queried in this way.

Note: If null session access is not permitted, a valid username and password must be provided.

rpcclient

rpcclient -U "" -N 10.0.0.3
Parameters
  • -U: Set the network username.

  • -N: Don’t ask for a password.

Commands that you can issue to SAMR, LSARPC, and LSARPC-DS.

Last updated