Pearson's OSCP Notebook

rpcdump

Properties1
tagsimpacket, rpcdump, rpc, msrpc, enumeration, endpoint-mapper, port-135, oscp

2 min read

rpcdump — Impacket RPC Enumeration

What is rpcdump?

impacket-rpcdump queries the RPC Endpoint Mapper (port 135) and lists registered MSRPC interfaces on a Windows host. Reveals what services expose RPC, including dynamic high ports used by DCOM, spooler, and other Windows components.

OSCP use: Map RPC surface after Nmap shows 135 open; complement rpcclient and RPC enum; find spooler/print services (PrintNightmare context); identify extra attack surface on DCs.

Full enum suite: Impacket Enumeration.

Syntax

impacket-rpcdump TARGET
impacket-rpcdump @TARGET
impacket-rpcdump domain/user:password@TARGET
impacket-rpcdump user@TARGET -hashes ':NT_HASH'

📌 1) Anonymous / Unauthenticated

impacket-rpcdump 192.168.229.247
impacket-rpcdump @192.168.229.247
 
# Specific port (non-standard RPC)
impacket-rpcdump 192.168.229.247 -port 49664

Example from labs — creds + dynamic RPC port:

rpcdump.py mark:OathDeeplyReprieve91@192.168.229.247 -p 49664
impacket-rpcdump mark:OathDeeplyReprieve91@192.168.229.247 -port 49664

(-p on script · -port on Kali impacket-rpcdump wrapper — same tool.)

📌 2) Authenticated

impacket-rpcdump corp.local/jsmith:Password1@10.10.10.10
impacket-rpcdump administrator@10.10.10.10 -hashes ':8846f7eaee8fb117ad06bdd830b7586c'

More interfaces visible with valid creds.

📌 3) Reading Output

Protocol: [MS-RSP]: Remote Spooler Protocol
Protocol: [MS-TSCH]: Task Scheduler Protocol
Protocol: [MS-EFSR]: Encrypting File System Remote Protocol
Protocol: [MS-SAMR]: Security Account Manager Remote Protocol
Protocol: [MS-LSAD]: Local Security Authority Domain Policy Remote Protocol
...
ProtocolRelevance
MS-RSP (Spooler)Print Spoofer / PrintNightmare
MS-EFSR (PetitPotam)Coerce auth / relay setups
MS-SAMR / MS-LSADUser enum → lookupsid & samrdump
MS-TSCHTask scheduler → atexec
MS-DCOMDCOM exec paths

📌 4) Workflow with Other Tools

nmap -p 135,445,49664 TARGET
    ↓
impacket-rpcdump TARGET
    ↓
impacket-lookupsid / rpcclient enumdomusers
    ↓
nxc smb TARGET -u user -p pass

See RPC, enum4linux, rpcclient.

📌 5) rpcdump vs rpcclient

ToolFocus
rpcdumpList RPC interfaces/endpoints
rpcclientInteractive SAMR/LSA user/group enum

Both use port 135 as entry point.

📌 Quick Cheat Sheet

impacket-rpcdump 10.10.10.10
impacket-rpcdump domain/user:pass@10.10.10.10
impacket-rpcdump user@10.10.10.10 -hashes ':NTHASH'
impacket-rpcdump 10.10.10.10 -port 49664
rpcdump.py mark:OathDeeplyReprieve91@192.168.229.247 -p 49664

Graph View

Backlinks