# Rpcclient

> Use for Windows RPC enumeration during authorized internal pentests. Trigger on share and domain discovery, account metadata review, and validating what information a target exposes over SMB and RPC.

- Skill: `timsonner/rpcclient` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/rpcclient`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/rpcclient/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/rpcclient

---


# Rpcclient

## Purpose

Use this skill for low-impact RPC-based enumeration against approved Windows targets.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to inspect what user, domain, or share metadata a target exposes.
- Need to validate anonymous versus authenticated RPC exposure.
- Need a narrow Windows enumeration path before deeper testing.

## Avoid When

- The host is out of scope.
- RPC enumeration would exceed the approved target or credential boundaries.

## Inputs

- Approved host
- Anonymous or authorized credential context
- Enumeration question or object focus

## Procedure

1. Start with the lightest query that answers the question.
2. Compare anonymous and authenticated exposure only when approved.
3. Record material metadata differences, not every response.
4. Correlate findings with domain and asset context.
5. Preserve the exact query path for retest.

## Command Syntax

Replace sample targets with approved in-scope assets and authorized credentials.

```bash
# Null session server info
rpcclient -U '' -N 10.10.10.100 -c 'srvinfo'

# Authenticated user enumeration
rpcclient -U 'contoso\auditor%<password>' 10.10.10.100 -c 'enumdomusers'

# Get user details by RID
rpcclient -U 'contoso\auditor%<password>' 10.10.10.100 -c 'queryuser 0x1f4'

# Enumerate domain groups
rpcclient -U 'contoso\auditor%<password>' 10.10.10.100 -c 'enumdomgroups'

# Look up SID for a named account
rpcclient -U 'contoso\auditor%<password>' 10.10.10.100 -c 'lookupnames administrator'

# Get domain LSA policy
rpcclient -U 'contoso\auditor%<password>' 10.10.10.100 -c 'lsaquery'
```

## Evidence to Capture

- Metadata or account information exposed by the target
- Differences between access contexts
- Exact host and query used for the material observation

## Safety Boundaries

- Keep enumeration focused on the approved question.
- Do not pivot into broader host exploration without explicit approval.