Skip to content
HackIndex.io

Detecting Sensitive MSRPC Interfaces

3 min read Created Jan 4, 2026 Last updated May 15, 2026

Sensitive MSRPC Interfaces

MSRPC services register their interfaces with the endpoint mapper on port 135. Each interface has a UUID that identifies the protocol it implements. Specific UUIDs correspond to Windows services that accept forced authentication. Running rpcdump against a host returns the full list of registered interfaces. Filtering for the coercion-relevant names tells you immediately whether the target is viable. You do not need to attempt coercion first - the interface registration confirms it will work.

Filter rpcdump Output

Query the endpoint mapper and filter for the four interfaces that matter for coercion attacks:

┌──(kali㉿kali)-[~]
└─$ impacket-rpcdump $TARGET_IP | grep -E 'MS-EFSR|MS-RPRN|MS-PAR|MS-EFSRPC'
Explain command
$TARGET_IP Target host IP address passed as argument to rpcdump.py.
-E Enables extended regex pattern matching in grep.
MS-EFSR|MS-RPRN|MS-PAR|MS-EFSRPC Regex alternation filtering for RPC interfaces related to print/file coerce attacks.

  • EFSR: Encrypting File System exposure.

  • RPRN: Print Spooler (PrintNightmare/Coercer).

  • PAR: Printer Access Rights.

  • EFSRPC: Alternate EFS binding.

When EFSR is present, the target runs the Encrypting File System Remote Protocol. PetitPotam abuses this interface to trigger outbound NTLM authentication to an attacker-controlled listener. RPRN means the Print Spooler service is active. SpoolSample and Coercer both use it to coerce authentication from the target. PAR is a secondary print protocol that provides the same coercion capability. It appears alongside RPRN on most hosts where Print Spooler is still running. EFSRPC is an alternate named pipe binding for the EFS service. It may succeed when MS-EFSR is blocked at the firewall or restricted via policy.

Presence of any of these interfaces is a direct precondition for coercion attacks: see AD Coercion Attacks.

Running rpcdump without credentials returns fewer results. Some interfaces only appear in the authenticated view. A low-privileged domain account is sufficient to see the full list. Use credentials whenever you have them - unauthenticated output can give a false negative on patched hosts where anonymous access is restricted.

Nmap Targeted Checks

Nmap's msrpc-enum script queries the endpoint mapper directly and lists registered interfaces with their UUIDs and transport bindings:

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script msrpc-enum $TARGET_IP
Explain command
-p 445 Scan only port 445 (SMB, used by msrpc-enum to reach RPC over named pipes).
--script msrpc-enum Run NSE script to enumerate MSRPC endpoints and interfaces.
$TARGET_IP Placeholder for the target host IP address.

The script output lists interface names, UUIDs, and the named pipe or TCP transport each interface binds to. It is less detailed than rpcdump but sufficient for a quick confirmation. If both tools return results, prefer the rpcdump output for documentation. rpcdump lists UUIDs explicitly, which makes it easier to cross-reference against CVE databases and vendor advisories.

When any of these interfaces are confirmed present, the target is viable for coercion. The next step is running Coercer with a Responder or ntlmrelayx listener active on the attacker machine to capture or relay the incoming NetNTLM hash.

References