MSRPC (Microsoft Remote Procedure Call) Pentesting
Last modified: 2023-02-08
It is also known as a function call or a subroutine call. Default ports are 135, 593.
Enumeration
nmap --script msrpc-enum -p 135 <target-ip>
# rpcdump
impacket-rpcdump -port 135 <target-ip>
# Find the Print System Remote Prototol or the Print System Asynchronous Remote Protocol
impacket-rpcdump -port 135 <target-ip> | grep -E 'MS-RPRN|MS-PAR'
# If we found them, we may can exploit with PrintNightmare.
# Metasploit
msfconsole
msf> use auxiliary/scanner/dcerpc/endpoint_mapper
msf> use auxiliary/scanner/dcerpc/hidden
msf> use auxiliary/scanner/dcerpc/management
msf> use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor
Investigation
rpcinfo reports RPC information. If you don’t have it, install ‘rpcbind’ first to use the rpcinfo.
sudo apt install rpcbind
Run the following command.
rpcinfo -p <target-ip>
# NFS only
rpcinfo -p <target-ip> | grep nfs
Connect
# Anonymous logon
rpcclient -N -U "" <target-ip>
rpcclient -N -U "" -p 593 <target-ip>
rpcclient -N -U "" dc.example.local
# Specify username
# -W: Workgroup
# -N: No password
rpcclient -U username <target-ip>
rpcclient -W WORKGROUP -U username <target-ip>
rpcclient -U username -N <target-ip>
# -k: Kerberos
rpcclient -k <target-ip>
Commands
# Server info
rpcclient $> srvinfo
# Enumerate domains
rpcclient $> enumdomains
# Enumerate domain users
rpcclient $> enumdomusers
# Enumerate domain groups
rpcclient $> enumdomgroups
# Domain info
rpcclient $> querydominfo
# Current username
rpcclient $> getusername
