{"id":384,"date":"2019-09-08T14:47:53","date_gmt":"2019-09-08T12:47:53","guid":{"rendered":"https:\/\/privat.andreas-klingler.de\/itsec\/?p=384"},"modified":"2021-02-28T18:21:44","modified_gmt":"2021-02-28T17:21:44","slug":"rpcinfo","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=384","title":{"rendered":"RPC<\/span> Remote Procedure Call"},"content":{"rendered":"\n

tcp\/135 udp\/135 \u2014 and as (Microsoft) Remote Pro\u00adce\u00addure Call on tcp\/593 as web service.<\/p>\n\n\n\n

Enumeration<\/h1>\n\n\n\n

Obtain gen\u00ader\u00adal information<\/p>\n\n\n\n

# rpcinfo -p $target\n# rpcinfo -s $target<\/pre>\n\n\n\n
Con\u00adnect. Hint: auto com\u00adple\u00adtion works; enum<tab><\/em> returns all enum commands.<\/p>\n\n\n\n
rpcclient -U \"\" $target<\/pre>\n\n\n\n
Enu\u00admer\u00adate through all API<\/span> end\u00adpoints with one of the fol\u00adlow\u00ading options.<\/p>\n\n\n\n
python \/usr\/local\/bin\/rpcdump.py $target | tee rpcdump.txt\nmsf > use auxiliary\/scanner\/dcerpc\/endpoint_mapper\nnmap -n -sV -p 135 --script=msrpc-enum $target\ngetArch.py -target $target<\/pre>\n\n\n\n
Check if RPC<\/span> ports allow\u00ading anony\u00admous access<\/p>\n\n\n\n
msf > use auxiliary\/scanner\/dcerpc\/hidden\nmsf > use auxiliary\/scanner\/dcerpc\/management<\/span>\nmsf > use auxiliary\/scanner\/dcerpc\/tcp_dcerpc_auditor<\/pre>\n\n\n\n
See here for a list what the UUIDs mean.<\/a><\/p>\n\n\n\n
Con\u00adnect direct\u00adly to an end\u00adpoint via<\/p>\n\n\n\n
rpcclient ncacn_ip_tcp:$target[49672]<\/pre>\n\n\n\n
But in gen\u00ader\u00adal, you can use rpc\u00adclient (see below) to access all end\u00adpoints in a shell.<\/p>\n\n\n\n
Enumerate with rpc<\/h2>\n\n\n\n
All users with their password<\/p>\n\n\n\n
for up in $(cat users_and_passwords.txt); do\n  username=$(echo $up | cut -d ':' -f 1)\n  password=$(echo $up | cut -d ':' -f 2)\n  echo \"$username \/ $password\"\n  rpcclient -U svcorp\\\\$username%$password $target\ndone;<\/pre>\n\n\n\n
All users with all passwords<\/p>\n\n\n\n
for user in $(cat users.txt); do\n  for p in $(cat test_passwords.txt); do\n    echo \"$user \/ $p\"\n    rpcclient -U svcorp\\\\$user%$p $target;\n  done;\ndone;\n<\/pre>\n\n\n\n
Enumeration with Impacket tools<\/h2>\n\n\n\n
See the Impack\u00adet post<\/a><\/p>\n\n\n\n
Accessing RCP<\/span> endpoints with rpcclient<\/h2>\n\n\n\n