Skip to content
HackIndex logo

HackIndex

MSRPC Endpoint Enumeration

2 min read May 15, 2026

Port 135 Endpoint Mapper lists bound RPC interfaces. Anonymous dumps expose service UUIDs; authenticated pulls more. Presence of EFSR, RPRN, or PAR flags relay or coercion vectors — for interface-level analysis see Detecting Sensitive MSRPC Interfaces, for relay setup see SMB NTLM Relay, and for coercion attack paths see AD Coercion Attacks.

Impacket rpcdump

Anonymous full dump:

┌──(kali㉿kali)-[~]
└─$ impacket-rpcdump $TARGET_IP
Explain command
$TARGET_IP Target host IP address to query for RPC endpoint mappings.

Lists protocols, UUIDs, versions, annotations. Filter sensitive:

┌──(kali㉿kali)-[~]
└─$ impacket-rpcdump $TARGET_IP | grep -E 'MS-EFSR|MS-RPRN|MS-PAR|MS-EFSRPC'
Explain command
$TARGET_IP Target host IP address to query for RPC endpoint mappings.
-E Enables extended regex matching in grep.
'MS-EFSR|MS-RPRN|MS-PAR|MS-EFSRPC' Regex pattern matching RPC protocols commonly abused for coerce attacks.

Authenticated:

┌──(kali㉿kali)-[~]
└─$ impacket-rpcdump $DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP
Explain command
$DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP Target credentials and host in domain/user:pass@IP format for RPC enumeration.

NTLM hash auth:

┌──(kali㉿kali)-[~]
└─$ impacket-rpcdump -hashes :$NTHASH $TARGET_IP
Explain command
-hashes :$NTHASH Authenticate using LM:NT hash pair; LM portion left empty.
$TARGET_IP Target host IP address to query for RPC endpoints.

Output shows ncacn_ip_tcp or ncacn_http bindings. HTTP on 593 indicates potential coercion paths.

Nmap msrpc-enum

Anonymous interface listing:

┌──(kali㉿kali)-[~]
└─$ nmap -p 135 --script msrpc-enum $TARGET_IP 
Host script results:
| msrpc-enum:
|
|     uuid: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5
|     annotation: DHCP Client LRPC Endpoint
|     ncalrpc: dhcpcsvc
|
|     uuid: 12345678-1234-abcd-ef00-0123456789ab
|     annotation: IPSec Policy agent endpoint
|     ncalrpc: audit
|
|     uuid: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5
|     ip_addr: 0.0.0.0
|     annotation: DHCP Client LRPC Endpoint
|     tcp_port: 49153
|
<snip>
|
|     uuid: 12345678-1234-abcd-ef00-0123456789ab
|     annotation: IPSec Policy agent endpoint
|     ncalrpc: securityevent
|
|     uuid: 12345678-1234-abcd-ef00-0123456789ab
|     annotation: IPSec Policy agent endpoint
|_    ncalrpc: protected_storage
Explain command
-p 135 Scan only port 135 (MS RPC endpoint mapper).
--script msrpc-enum Run NSE script to enumerate MSRPC endpoints on the target.
$TARGET_IP Placeholder for the target host IP address.

Reports UUIDs and names. Slower but no dependencies.

References