# MSRPC

> Windows remote procedure calls

- **URL:** https://hackindex.io/services/msrpc
- **Type:** Service
- **Default ports:** 135
- **Tags:** windows, rpc, network, lateral-movement, smb, active-directory
- **Published:** 2025-12-31
- **Updated:** 2026-07-13

MSRPC (Microsoft Remote Procedure Call) uses **TCP port 135** as the endpoint mapper, with actual RPC services running on dynamic high ports (49152+). Nmap identifies port 135 as `msrpc`. MSRPC underpins many Windows services including DCOM, WMI, task scheduler, and Active Directory replication.

The endpoint mapper on port 135 reveals which RPC services are available and their dynamic port assignments. This information helps map Windows services on the target. RPC interfaces can also be abused for remote code execution, lateral movement, and enumeration of users, shares, and policies.

Query the endpoint mapper with `rpcdump.py` from Impacket or `rpcinfo`. Use `rpcclient` for null session or authenticated enumeration of users, groups, and domain info. Tools like `IOXIDResolver.py` can reveal additional network interfaces through DCOM.

## Phases

- [Enumeration](https://hackindex.io/services/msrpc/enumeration.md): RPC endpoint scanning, SAMR/LSA queries, SID brute forcing, coercion interf (4 guides)
- [Exploitation](https://hackindex.io/services/msrpc/exploitation.md): Execute commands via DCOM objects over MSRPC using impacket (1 guides)