# MSRPC Endpoint Enumeration

- **URL:** https://hackindex.io/services/msrpc/enumeration/msrpc-endpoint-enumeration
- **Path:** MSRPC > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/msrpc/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-05-15

Port 135 runs the Endpoint Mapper, the RPC service registry for all bound interfaces on a Windows host. Querying it returns UUIDs, protocol sequences, and endpoints for every currently registered RPC service. Run this early because it reveals what services are actually running, not just which ports are reachable.

Anonymous queries succeed on most default Windows configurations. Authenticated queries return a fuller interface list. On domain controllers, some interfaces only appear after authentication or when specific services are active.

Flag these interfaces immediately: MS-EFSR (Encrypting File System Remote), MS-RPRN (Print Spooler), MS-PAR (Print Async Notify), and MS-EFSRPC. These are coercion-capable interfaces. If any appear, you can force the target to authenticate outbound and capture or relay that credential. For interface-level analysis see [Detecting Sensitive MSRPC Interfaces](https://hackindex.io/services/msrpc/enumeration/detecting-sensitive-msrpc-interfaces), for relay setup see [SMB NTLM Relay](https://hackindex.io/services/smb/exploitation/ntlm-relay), and for coercion attack paths see [AD Coercion Attacks](https://hackindex.io/platforms/active-directory/exploitation/ad-coercion-attacks).

## Impacket rpcdump

Anonymous full dump:

- Impacket rpcdump
- Nmap msrpc-enum

```bash
impacket-rpcdump $TARGET_IP
```

The output lists every registered endpoint: UUID, protocol sequence (ncacn_ip_tcp for TCP, ncalrpc for local RPC only), port or pipe name, and annotation string. The annotation typically names the service. Unannotated entries are worth investigating. Unknown UUIDs can be cross-referenced against Microsoft's published RPC interface list. Look for dynamic TCP ports bound to suspicious or unnamed interfaces.

Filter for coercion-capable interfaces:

```bash
impacket-rpcdump $TARGET_IP | grep -E 'MS-EFSR|MS-RPRN|MS-PAR|MS-EFSRPC'
```

Any hit here is actionable. Each matching interface represents a path to force outbound authentication from the target. Confirm the interface is actually registered before pivoting to a coercion attack. Authenticated pull reveals more registered interfaces:

```bash
impacket-rpcdump $DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP
```

Authenticated results typically expose more interfaces, including those restricted to domain users. Compare the authenticated list against the anonymous dump to identify interfaces hidden from unauthenticated callers. NTLM hash authentication works the same way:

```bash
impacket-rpcdump -hashes :$NTHASH $TARGET_IP
```

The binding protocol in the output matters. ncacn_ip_tcp means the interface listens on a TCP port and is reachable over the network. ncalrpc is local RPC only, not accessible remotely. ncacn_http on port 593 is HTTP-tunneled RPC. HTTP-tunneled RPC sometimes bypasses firewall rules that block port 135 directly and can open additional coercion paths.

## Nmap msrpc-enum

Anonymous interface listing:

```bash
nmap -p 445 --script msrpc-enum $TARGET_IP
# Host script results:
# | msrpc-enum:
# |
# |     uuid: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5
# |     annotation: DHCP Client LRPC Endpoint
# |     ncalrpc: dhcpcsvc
# |
# |     uuid: 12345678-1234-abcd-ef00-0123456789ab
# |     annotation: IPSec Policy agent endpoint
# |     ncalrpc: audit
# |
# |     uuid: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5
# |     ip_addr: 0.0.0.0
# |     annotation: DHCP Client LRPC Endpoint
# |     tcp_port: 49153
# |
# <snip>
# |
# |     uuid: 12345678-1234-abcd-ef00-0123456789ab
# |     annotation: IPSec Policy agent endpoint
# |     ncalrpc: securityevent
# |
# |     uuid: 12345678-1234-abcd-ef00-0123456789ab
# |     annotation: IPSec Policy agent endpoint
# |_    ncalrpc: protected_storage
```

The msrpc-enum script connects to port 135 and resolves registered endpoints without external dependencies. It does not support credentials, so the output may be incomplete compared to an authenticated rpcdump. Use it when Impacket is unavailable, such as from a minimal pivot host or a system without Python. The UUID annotations in the output map to service names. Flag any UUID that matches known coercion interfaces and follow up with rpcdump for a full authenticated pull.

## References

- [Impacket repository](https://github.com/fortra/impacket) - rpcdump.py for endpoint dumping
- [msrpc-enum NSE script](https://nmap.org/nsedoc/scripts/msrpc-enum.html) - RPC interface enumeration