# Detecting Sensitive MSRPC Interfaces

> Enumerates exposed MSRPC interfaces to identify sensitive endpoints like SAMR, LSARPC, and DRSUAPI that may allow credential theft or privilege escalation.

- **URL:** https://hackindex.io/services/msrpc/enumeration/detecting-sensitive-msrpc-interfaces
- **Path:** MSRPC > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/msrpc/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-05-15

## Sensitive MSRPC Interfaces

MSRPC services register their interfaces with the endpoint mapper on port 135. Each interface has a UUID that identifies the protocol it implements. Specific UUIDs correspond to Windows services that accept forced authentication. Running rpcdump against a host returns the full list of registered interfaces. Filtering for the coercion-relevant names tells you immediately whether the target is viable. You do not need to attempt coercion first - the interface registration confirms it will work.

## Filter rpcdump Output

Query the endpoint mapper and filter for the four interfaces that matter for coercion attacks:

```bash
impacket-rpcdump $TARGET_IP | grep -E 'MS-EFSR|MS-RPRN|MS-PAR|MS-EFSRPC'
```

- EFSR: Encrypting File System exposure.
- RPRN: Print Spooler (PrintNightmare/Coercer).
- PAR: Printer Access Rights.
- EFSRPC: Alternate EFS binding.

When EFSR is present, the target runs the Encrypting File System Remote Protocol. PetitPotam abuses this interface to trigger outbound NTLM authentication to an attacker-controlled listener. RPRN means the Print Spooler service is active. SpoolSample and Coercer both use it to coerce authentication from the target. PAR is a secondary print protocol that provides the same coercion capability. It appears alongside RPRN on most hosts where Print Spooler is still running. EFSRPC is an alternate named pipe binding for the EFS service. It may succeed when MS-EFSR is blocked at the firewall or restricted via policy.

Presence of any of these interfaces is a direct precondition for coercion attacks: see [AD Coercion Attacks](https://hackindex.io/platforms/active-directory/exploitation/ad-coercion-attacks).

Running rpcdump without credentials returns fewer results. Some interfaces only appear in the authenticated view. A low-privileged domain account is sufficient to see the full list. Use credentials whenever you have them - unauthenticated output can give a false negative on patched hosts where anonymous access is restricted.

## Nmap Targeted Checks

Nmap's msrpc-enum script queries the endpoint mapper directly and lists registered interfaces with their UUIDs and transport bindings:

```bash
nmap -p 445 --script msrpc-enum $TARGET_IP
```

The script output lists interface names, UUIDs, and the named pipe or TCP transport each interface binds to. It is less detailed than rpcdump but sufficient for a quick confirmation. If both tools return results, prefer the rpcdump output for documentation. rpcdump lists UUIDs explicitly, which makes it easier to cross-reference against CVE databases and vendor advisories.

When any of these interfaces are confirmed present, the target is viable for coercion. The next step is running Coercer with a Responder or ntlmrelayx listener active on the attacker machine to capture or relay the incoming NetNTLM hash.

## References

- [Impacket repository](https://github.com/fortra/impacket) - rpcdump.py sensitive interface detection