How do I install the Rpcclient Enumeration skill?

Run npx skillmds@latest add abelrguezr/rpcclient-enumeration in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Rpcclient Enumeration safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Rpcclient Enumeration?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Rpcclient Enumeration free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Rpcclient Enumeration?

abelrguezr (@abelrguezr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Rpcclient Enumeration by abelrguezr

Name: Rpcclient Enumeration
Rating: 4.2 (5 reviews)
Author: abelrguezr

Rpcclient Enumeration

Use rpcclient to enumerate Windows systems via SMB/RPC. Use this skill whenever the user needs to enumerate users, groups, domains, or shares on a Windows target, or when they mention rpcclient, SMB enumeration, RID cycling, SID enumeration, or Windows domain reconnaissance. This skill provides commands and scripts for SAMR, LSARPC, and LSARPC-DS interfaces.

abelrguezr Updated Sep 10, 2026

File contents

RPCClient Enumeration

A skill for enumerating Windows systems using rpcclient from Samba. This covers user, group, domain, and share enumeration through SMB/RPC interfaces.

When to Use This Skill

Use this skill when:

You need to enumerate users, groups, or domains on a Windows target
You have SMB access and want to extract information via RPC
You're doing Windows domain reconnaissance
You need to cycle through RIDs to find valid users
You're working with SAMR, LSARPC, or LSARPC-DS interfaces

Prerequisites

SMB session established to target
Credentials (or null session with -N -U "")
rpcclient from Samba installed

Core Concepts

SIDs and RIDs

SID (Security Identifier): Unique identifier for a domain
RID (Relative Identifier): Appended to SID to identify objects within the domain
Full SID format: S-1-5-21-<domain-rid>-<user-rid>
Example: S-1-5-21-1074507654-1937615267-42093643874-1111 (user pepe with RID 1111)

Quick Start

# Basic connection (null session)
rpcclient -N -U "" [TARGET_IP]

# With credentials
rpcclient -U [username] [TARGET_IP]

User Enumeration

List All Users

querydispinfo
enumdomusers

Get User Details

queryuser <0xrid>

Get User Groups

queryusergroups <0xrid>

Get User SID

lookupnames <username>

Get User Aliases

queryuseraliases [builtin|domain] <sid>

RID Cycling Script

Use the bundled script to enumerate users by cycling through RIDs:

./scripts/rpcclient-rid-cycler.sh [TARGET_IP] [START_RID] [END_RID]

Default range is 500-1100 (common user RIDs).

Group Enumeration

List All Groups

enumdomgroups

Get Group Details

querygroup <0xrid>

Get Group Members

querygroupmem <0xrid>

Alias Groups

enumalsgroups [builtin|domain]
queryaliasmem [builtin|domain] <0xrid>

Domain Enumeration

List Domains

enumdomains

Get Domain SID

lsaquery

Get Domain Info

querydominfo

Trusted Domains

dsenumdomtrusts

Primary Domain Info

dsroledominfo

Share Enumeration

List All Shares

netshareenumall

Get Share Info

netsharegetinfo <share>

Server Information

srvinfo

Command Reference

Command	Interface	Description
queryuser	SAMR	Retrieve user information
querygroup	SAMR	Retrieve group information
querydominfo	SAMR	Retrieve domain information
enumdomusers	SAMR	Enumerate domain users
enumdomgroups	SAMR	Enumerate domain groups
createdomuser	SAMR	Create a domain user
deletedomuser	SAMR	Delete a domain user
lookupnames	LSARPC	Look up usernames to SID values
lookupsids	LSARPC	Look up SIDs to usernames (RID cycling)
lsaaddacctrights	LSARPC	Add rights to a user account
lsaremoveacctrights	LSARPC	Remove rights from a user account
dsroledominfo	LSARPC-DS	Get primary domain information
dsenumdomtrusts	LSARPC-DS	Enumerate trusted domains within an AD forest

Tips

RID ranges: Common user RIDs start at 500. Admin accounts often have RIDs 500-515.
Null sessions: Try -N -U "" first before using credentials.
Error handling: Some commands may fail if permissions are insufficient.
Combine with other tools: Use samrdump.py for additional enumeration.
Document findings: Save output for later analysis.

Related Skills

SMB enumeration
Windows domain reconnaissance
MSRPC pentesting

---name: rpcclient-enumerationdescription: Use rpcclient to enumerate Windows systems via SMB/RPC. Use this skill whenever the user needs to enumerate users, groups, domains, or shares on a Windows target, or when they mention rpcclient, SMB enumeration, RID cycling, SID enumeration, or Windows domain reconnaissance. This skill provides commands and scripts for SAMR, LSARPC, and LSARPC-DS interfaces.---# RPCClient EnumerationA skill for enumerating Windows systems using rpcclient from Samba. This covers user, group, domain, and share enumeration through SMB/RPC interfaces.## When to Use This SkillUse this skill when:- You need to enumerate users, groups, or domains on a Windows target- You have SMB access and want to extract information via RPC- You're doing Windows domain reconnaissance- You need to cycle through RIDs to find valid users- You're working with SAMR, LSARPC, or LSARPC-DS interfaces## Prerequisites- SMB session established to target- Credentials (or null session with `-N -U ""`)- rpcclient from Samba installed## Core Concepts### SIDs and RIDs- **SID (Security Identifier)**: Unique identifier for a domain- **RID (Relative Identifier)**: Appended to SID to identify objects within the domain- **Full SID format**: `S-1-5-21-<domain-rid>-<user-rid>`- **Example**: `S-1-5-21-1074507654-1937615267-42093643874-1111` (user pepe with RID 1111)## Quick Start```bash# Basic connection (null session)rpcclient -N -U "" [TARGET_IP]# With credentialsrpcclient -U [username] [TARGET_IP]```## User Enumeration### List All Users```bashquerydispinfoenumdomusers```### Get User Details```bashqueryuser <0xrid>```### Get User Groups```bashqueryusergroups <0xrid>```### Get User SID```bashlookupnames <username>```### Get User Aliases```bashqueryuseraliases [builtin|domain] <sid>```### RID Cycling ScriptUse the bundled script to enumerate users by cycling through RIDs:```bash./scripts/rpcclient-rid-cycler.sh [TARGET_IP] [START_RID] [END_RID]```Default range is 500-1100 (common user RIDs).## Group Enumeration### List All Groups```bashenumdomgroups```### Get Group Details```bashquerygroup <0xrid>```### Get Group Members```bashquerygroupmem <0xrid>```### Alias Groups```bashenumalsgroups [builtin|domain]queryaliasmem [builtin|domain] <0xrid>```## Domain Enumeration### List Domains```bashenumdomains```### Get Domain SID```bashlsaquery```### Get Domain Info```bashquerydominfo```### Trusted Domains```bashdsenumdomtrusts```### Primary Domain Info```bashdsroledominfo```## Share Enumeration### List All Shares```bashnetshareenumall```### Get Share Info```bashnetsharegetinfo <share>```## Server Information```bashsrvinfo```## Command Reference| Command | Interface | Description ||---------|-----------|-------------|| queryuser | SAMR | Retrieve user information || querygroup | SAMR | Retrieve group information || querydominfo | SAMR | Retrieve domain information || enumdomusers | SAMR | Enumerate domain users || enumdomgroups | SAMR | Enumerate domain groups || createdomuser | SAMR | Create a domain user || deletedomuser | SAMR | Delete a domain user || lookupnames | LSARPC | Look up usernames to SID values || lookupsids | LSARPC | Look up SIDs to usernames (RID cycling) || lsaaddacctrights | LSARPC | Add rights to a user account || lsaremoveacctrights | LSARPC | Remove rights from a user account || dsroledominfo | LSARPC-DS | Get primary domain information || dsenumdomtrusts | LSARPC-DS | Enumerate trusted domains within an AD forest |## Tips1. **RID ranges**: Common user RIDs start at 500. Admin accounts often have RIDs 500-515.2. **Null sessions**: Try `-N -U ""` first before using credentials.3. **Error handling**: Some commands may fail if permissions are insufficient.4. **Combine with other tools**: Use samrdump.py for additional enumeration.5. **Document findings**: Save output for later analysis.## Related Skills- SMB enumeration- Windows domain reconnaissance- MSRPC pentesting

Frequently asked questions