Rpcclient

Rpcclient

Purpose

Use this skill for low-impact RPC-based enumeration against approved Windows targets.

Phase Fit

• Primary: Discovery and Reconnaissance, Vulnerability Analysis
• Secondary: Retest and Closure

Use When

• Need to inspect what user, domain, or share metadata a target exposes.
• Need to validate anonymous versus authenticated RPC exposure.
• Need a narrow Windows enumeration path before deeper testing.

Avoid When

• The host is out of scope.
• RPC enumeration would exceed the approved target or credential boundaries.

Inputs

• Approved host
• Anonymous or authorized credential context
• Enumeration question or object focus

Procedure

1. Start with the lightest query that answers the question.
2. Compare anonymous and authenticated exposure only when approved.
3. Record material metadata differences, not every response.
4. Correlate findings with domain and asset context.
5. Preserve the exact query path for retest.

Command Syntax

Replace sample targets with approved in-scope assets and authorized credentials.

# Null session server info
rpcclient -U '' -N 10.10.10.100 -c 'srvinfo'

# Authenticated user enumeration
rpcclient -U 'contoso\auditor%<password>' 10.10.10.100 -c 'enumdomusers'

# Get user details by RID
rpcclient -U 'contoso\auditor%<password>' 10.10.10.100 -c 'queryuser 0x1f4'

# Enumerate domain groups
rpcclient -U 'contoso\auditor%<password>' 10.10.10.100 -c 'enumdomgroups'

# Look up SID for a named account
rpcclient -U 'contoso\auditor%<password>' 10.10.10.100 -c 'lookupnames administrator'

# Get domain LSA policy
rpcclient -U 'contoso\auditor%<password>' 10.10.10.100 -c 'lsaquery'

Evidence to Capture

• Metadata or account information exposed by the target
• Differences between access contexts
• Exact host and query used for the material observation

Safety Boundaries

• Keep enumeration focused on the approved question.
• Do not pivot into broader host exploration without explicit approval.