> For the complete documentation index, see [llms.txt](https://docs.qu35t.pw/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.qu35t.pw/rpc.md).

# RPC

## RPCClient

{% tabs %}
{% tab title="Null authentication" %}

```bash
rpcclient -U '' -N 10.10.10.10
```

{% endtab %}

{% tab title="Basic authentication" %}

```bash
rpcclient -U 'qu35t' 10.10.10.10
```

{% endtab %}
{% endtabs %}

### Enumeration

{% tabs %}
{% tab title="Users" %}
List all users.

```bash
enumdomusers
```

Get informations from a user.

```bash
queryuser 0x450
```

{% endtab %}

{% tab title="Groups" %}
List all groups.

```bash
enumdomgroups
```

Get informations from a group.

```bash
querygroup 0x450
```

Show members of a group.

```bash
querygroupmem 0x450
```

{% endtab %}

{% tab title="Printers" %}

```bash
enumprinters
```

{% endtab %}

{% tab title="Domains" %}
List all domains.

```bash
enumdomains
```

Get informations from a domain.

```bash
querydominfo
```

{% endtab %}

{% tab title="Shares" %}
List all shares.

```bash
netshareenumall
```

Get share informations.

```bash
netsharegetinfo notes
```

{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="User SID" %}

```bash
lookupnames qu35t
```

{% endtab %}

{% tab title="AD information" %}

```bash
querydisplayinfo
```

{% endtab %}

{% tab title="Bruteforce RID/SID" %}

```bash
lookupsids S-1-5-21-4254423774-1266059056-3197185112-1008
```

Brute forcing user RIDs.

```bash
for i in $(seq 500 1100);do rpcclient -N -U "" 10.10.10.10 -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" && echo "";done
```

With an impacket script.

```bash
samrdump.py 10.10.10.10
```

{% endtab %}

{% tab title="Edit a user's password" %}

```bash
setuserinfo2 'qu35t' 23 'NewPassw0rd!'
```

{% endtab %}
{% endtabs %}

## References

* [samdump.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/samrdump.py)