135, 593 - MSRPC

Enumeration

You can query the RPC locator service and individual RPC endpoints to catalog services running over TCP, UDP, HTTP, and SMB (via named pipes).

Each returned IFID value represents an RPC service. See Notable RPC Interfaces.

By default, impacket will try to match them with a list of well known endpoints.

impacket rpcdump.py

Dump the list of RPC endpoints.

impacket-rpcdump TARGET

Parameters

target: [[domain/]username[:password]@]address
-port <ports>: Destination port to connect to SMB server. Default: 135.

impacket samrdump.py

List system user accounts, available resource shares and other sensitive information exported through the SAMR (Security Account Manager Remote) interface.

impacket-samrdump TARGET

Parameters

target: [[domain/]username[:password]@]address
-port <ports>: Destination port to connect to SMB server. Default: 445.

msrpc-enum NSE Script

nmap -sV -script msrpc-enum -Pn 10.0.0.3

Query RPC

The rpcclient can be used to interact with individual RPC endpoints via named pipes. By default, Windows systems and Windows 2003 domain controllers allow anonymous (Null Sessions) access to SMB, so these interfaces can be queried in this way.

Note: If null session access is not permitted, a valid username and password must be provided.

rpcclient

rpcclient -U "" -N 10.0.0.3

Parameters

-U: Set the network username.
-N: Don’t ask for a password.

Commands that you can issue to SAMR, LSARPC, and LSARPC-DS.

Command	Interface	Description
`queryuser`	SAMR	Retrieve user information.
`querygroup`	SAMR	Retrieve group information.
`querydominfo`	SAMR	Retrieve domain information.
`enumdomusers`	SAMR	Enumerate domain users.
`enumdomgroups`	SAMR	Enumerate domain groups.
`createdomuser`	SAMR	Create a domain user.
`deletedomuser`	SAMR	Delete a domain user.
`lookupnames`	LSARPC	Look up usernames to SID values.
`lookupsids`	LSARPC	Look up SIDs to usernames (RID cycling).
`lsaaddacctrights`	LSARPC	Add rights to a user account.
`lsaremoveacctrights`	LSARPC	Remove rights from a user account.
`dsroledominfo`	LSARPC-DS	Get primary domain information.
`dsenumdomtrusts`	LSARPC-DS	Enumerate trusted domains within an AD forest