HackIndex.io
Language
MSRPC (Microsoft Remote Procedure Call) uses TCP port 135 as the endpoint mapper, with actual RPC services running on dynamic high ports (49152+). Nmap identifies port 135 as msrpc. MSRPC underpins many Windows services including DCOM, WMI, task scheduler, and Active Directory replication.
The endpoint mapper on port 135 reveals which RPC services are available and their dynamic port assignments. This information helps map Windows services on the target. RPC interfaces can also be abused for remote code execution, lateral movement, and enumeration of users, shares, and policies.
Query the endpoint mapper with rpcdump.py from Impacket or rpcinfo. Use rpcclient for null session or authenticated enumeration of users, groups, and domain info. Tools like IOXIDResolver.py can reveal additional network interfaces through DCOM.
RPC endpoint scanning, SAMR/LSA queries, SID brute forcing, coercion interf
Enumerates exposed MSRPC interfaces to identify sensitive endpoints like SAMR, LSARPC, and DRSUAPI that may allow credential theft or privilege escalation.
Enumerate valid Windows SIDs via MSRPC using brute-force techniques to discover user accounts, groups, and domain objects through the LSA and SAMR interfaces.
Execute commands via DCOM objects over MSRPC using impacket
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.