Skip to content
HackIndex logo

HackIndex

Detecting Sensitive MSRPC Interfaces

1 min read May 15, 2026

Certain UUIDs indicate vulnerable services. Presence alone confirms coercion targets.

Filter rpcdump Output

From full dump:

┌──(kali㉿kali)-[~]
└─$ impacket-rpcdump $TARGET_IP | grep -E 'MS-EFSR|MS-RPRN|MS-PAR|MS-EFSRPC'
Explain command
$TARGET_IP Target host IP address passed as argument to rpcdump.py.
-E Enables extended regex pattern matching in grep.
MS-EFSR|MS-RPRN|MS-PAR|MS-EFSRPC Regex alternation filtering for RPC interfaces related to print/file coerce attacks.

  • EFSR: Encrypting File System exposure.

  • RPRN: Print Spooler (PrintNightmare/Coercer).

  • PAR: Printer Access Rights.

  • EFSRPC: Alternate EFS binding.

Presence of these interfaces is a direct precondition for coercion attacks — see AD Coercion Attacks.

Authenticated increases visibility.

Nmap Targeted Checks

msrpc-enum with filter:

┌──(kali㉿kali)-[~]
└─$ nmap -p 135 --script msrpc-enum $TARGET_IP | grep -E 'EFSR|RPRN|PAR'
Explain command
-p 135 Scan only port 135 (Microsoft RPC endpoint mapper).
--script msrpc-enum Run NSE script to enumerate MSRPC endpoints and interfaces.
$TARGET_IP Placeholder for the target host IP address.
-E 'EFSR|RPRN|PAR' Filter output for EFSR, RPRN, or PAR RPC interface names.

References