RPC

RPCClient

Null authentication

rpcclient -U '' -N 10.10.10.10

Basic authentication

rpcclient -U 'qu35t' 10.10.10.10

Enumeration

Users

List all users.

enumdomusers

Get informations from a user.

queryuser 0x450

Groups

List all groups.

enumdomgroups

Get informations from a group.

querygroup 0x450

Show members of a group.

querygroupmem 0x450

Printers

enumprinters

Domains

List all domains.

enumdomains

Get informations from a domain.

querydominfo

Shares

List all shares.

netshareenumall

Get share informations.

netsharegetinfo notes

User SID

lookupnames qu35t

AD information

querydisplayinfo

Bruteforce RID/SID

lookupsids S-1-5-21-4254423774-1266059056-3197185112-1008

Brute forcing user RIDs.

for i in $(seq 500 1100);do rpcclient -N -U "" 10.10.10.10 -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" && echo "";done

With an impacket script.

samrdump.py 10.10.10.10

Edit a user's password

setuserinfo2 'qu35t' 23 'NewPassw0rd!'

References

• samdump.py