RPC

• Usually on port 135, 593

Enumerate RPC

rpcclient

• rpcclient -U "" -c "enumdomusers" -N 10.10.10.161 enumerate users

• rpcclient -U "" -c "enumprivs" -N 10.10.10.161 enumerate privileges

• Get domain info rpcclient -U "" -c "querydominfo" -N 10.10.10.161

• rpcclient -U "" -c "enumdomgroups" -N 10.10.10.161 enumerate group

Resources

Active Directory Enumeration: RPCClientHacking Articles

Active Directory Enumeration: RPCClient

https://book.hacktricks.xyz/network-services-pentesting/135-pentesting-msrpcbook.hacktricks.xyz

Pentesting MSRPC