Skip to content
HackIndex.io

MSRPC Endpoint Enumeration

4 min read Created Jan 4, 2026 Last updated May 15, 2026

Port 135 runs the Endpoint Mapper, the RPC service registry for all bound interfaces on a Windows host. Querying it returns UUIDs, protocol sequences, and endpoints for every currently registered RPC service. Run this early because it reveals what services are actually running, not just which ports are reachable.

Anonymous queries succeed on most default Windows configurations. Authenticated queries return a fuller interface list. On domain controllers, some interfaces only appear after authentication or when specific services are active.

Flag these interfaces immediately: MS-EFSR (Encrypting File System Remote), MS-RPRN (Print Spooler), MS-PAR (Print Async Notify), and MS-EFSRPC. These are coercion-capable interfaces. If any appear, you can force the target to authenticate outbound and capture or relay that credential. For interface-level analysis see Detecting Sensitive MSRPC Interfaces, for relay setup see SMB NTLM Relay, and for coercion attack paths see AD Coercion Attacks.

Impacket rpcdump

Anonymous full dump:

  • Impacket rpcdump
  • Nmap msrpc-enum
┌──(kali㉿kali)-[~]
└─$ impacket-rpcdump $TARGET_IP
Explain command
$TARGET_IP Target host IP address to query for RPC endpoint mappings.

The output lists every registered endpoint: UUID, protocol sequence (ncacn_ip_tcp for TCP, ncalrpc for local RPC only), port or pipe name, and annotation string. The annotation typically names the service. Unannotated entries are worth investigating. Unknown UUIDs can be cross-referenced against Microsoft's published RPC interface list. Look for dynamic TCP ports bound to suspicious or unnamed interfaces.

Filter for coercion-capable interfaces:

┌──(kali㉿kali)-[~]
└─$ impacket-rpcdump $TARGET_IP | grep -E 'MS-EFSR|MS-RPRN|MS-PAR|MS-EFSRPC'
Explain command
$TARGET_IP Target host IP address to query for RPC endpoint mappings.
-E Enables extended regex matching in grep.
'MS-EFSR|MS-RPRN|MS-PAR|MS-EFSRPC' Regex pattern matching RPC protocols commonly abused for coerce attacks.

Any hit here is actionable. Each matching interface represents a path to force outbound authentication from the target. Confirm the interface is actually registered before pivoting to a coercion attack. Authenticated pull reveals more registered interfaces:

┌──(kali㉿kali)-[~]
└─$ impacket-rpcdump $DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP
Explain command
$DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP Target credentials and host in domain/user:pass@IP format for RPC enumeration.

Authenticated results typically expose more interfaces, including those restricted to domain users. Compare the authenticated list against the anonymous dump to identify interfaces hidden from unauthenticated callers. NTLM hash authentication works the same way:

┌──(kali㉿kali)-[~]
└─$ impacket-rpcdump -hashes :$NTHASH $TARGET_IP
Explain command
-hashes :$NTHASH Authenticate using LM:NT hash pair; LM portion left empty.
$TARGET_IP Target host IP address to query for RPC endpoints.

The binding protocol in the output matters. ncacn_ip_tcp means the interface listens on a TCP port and is reachable over the network. ncalrpc is local RPC only, not accessible remotely. ncacn_http on port 593 is HTTP-tunneled RPC. HTTP-tunneled RPC sometimes bypasses firewall rules that block port 135 directly and can open additional coercion paths.

Nmap msrpc-enum

Anonymous interface listing:

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script msrpc-enum $TARGET_IP 
Host script results:
| msrpc-enum:
|
|     uuid: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5
|     annotation: DHCP Client LRPC Endpoint
|     ncalrpc: dhcpcsvc
|
|     uuid: 12345678-1234-abcd-ef00-0123456789ab
|     annotation: IPSec Policy agent endpoint
|     ncalrpc: audit
|
|     uuid: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5
|     ip_addr: 0.0.0.0
|     annotation: DHCP Client LRPC Endpoint
|     tcp_port: 49153
|
<snip>
|
|     uuid: 12345678-1234-abcd-ef00-0123456789ab
|     annotation: IPSec Policy agent endpoint
|     ncalrpc: securityevent
|
|     uuid: 12345678-1234-abcd-ef00-0123456789ab
|     annotation: IPSec Policy agent endpoint
|_    ncalrpc: protected_storage
Explain command
-p 445 Scan only port 445 (SMB, used by msrpc-enum to reach RPC over named pipes).
--script msrpc-enum Run NSE script to enumerate MSRPC endpoints on the target.
$TARGET_IP Placeholder for the target host IP address.

The msrpc-enum script connects to port 135 and resolves registered endpoints without external dependencies. It does not support credentials, so the output may be incomplete compared to an authenticated rpcdump. Use it when Impacket is unavailable, such as from a minimal pivot host or a system without Python. The UUID annotations in the output map to service names. Flag any UUID that matches known coercion interfaces and follow up with rpcdump for a full authenticated pull.

References