Tool for executing MS-RPC functions on Windows systems.
rpcclient [options] <server>
| Option | Description | Example |
|---|
-U USER | Username | rpcclient -U admin 10.10.10.10 |
-W DOMAIN | Domain/Workgroup | rpcclient -U admin -W MYDOMAIN 10.10.10.10 |
-N | No password (null session) | rpcclient -U '' -N 10.10.10.10 |
-c CMD | Execute command and exit | rpcclient -U admin -c 'enumdomusers' 10.10.10.10 |
--pw-nt-hash | Use NT hash for auth | rpcclient -U admin --pw-nt-hash 10.10.10.10 |
rpcclient -U '' -N 10.10.10.10
rpcclient -U 'admin%Password123' 10.10.10.10
rpcclient -U 'DOMAIN\admin%Password123' 10.10.10.10
| Command | Description |
|---|
srvinfo | Server information |
querydispinfo | List users with descriptions |
querydominfo | Domain information |
netshareenum | Enumerate shares |
netshareenumall | Enumerate all shares |
| Command | Description |
|---|
enumdomusers | Enumerate domain users |
enumdomgroups | Enumerate domain groups |
queryuser <RID> | Query user by RID |
queryusergroups <RID> | Query user’s groups |
lookupnames <name> | Look up SID for name |
lookupsids <SID> | Look up name for SID |
| Command | Description |
|---|
enumdomgroups | List domain groups |
querygroup <RID> | Query group by RID |
querygroupmem <RID> | Query group members |
enumalsgroups builtin | Enumerate builtin groups |
enumalsgroups domain | Enumerate domain local groups |
| Command | Description |
|---|
getdompwinfo | Get domain password info |
getusrdompwinfo <RID> | Get user password info |
| Command | Description |
|---|
createdomuser <user> | Create domain user |
deletedomuser <user> | Delete domain user |
setuserinfo2 <user> 23 <pass> | Change user password |
chgpasswd <user> <oldpass> <newpass> | Change password |
rpcclient -U '' -N 10.10.10.10 -c 'enumdomusers'
Output format: user:[username] rid:[0xRID]
rpcclient -U '' -N 10.10.10.10 -c 'queryuser 0x1f4'
Note: 0x1f4 = 500 = Administrator RID
rpcclient -U '' -N 10.10.10.10 -c 'enumdomgroups'
rpcclient -U '' -N 10.10.10.10 -c 'getdompwinfo'
for i in $(seq 500 1100); do
rpcclient -U '' -N 10.10.10.10 -c "queryuser 0x$(printf '%x' $i)" 2>/dev/null | grep "User Name"
done
rpcclient -U 'admin%Password123' 10.10.10.10 -c 'createdomuser newuser'
rpcclient -U 'admin%Password123' 10.10.10.10 -c 'setuserinfo2 newuser 23 NewPass123!'
rpcclient -U 'admin%Password123' 10.10.10.10 -c 'chgpasswd username oldpass newpass'
| RID (Hex) | RID (Dec) | Account |
|---|
| 0x1f4 | 500 | Administrator |
| 0x1f5 | 501 | Guest |
| 0x1f6 | 502 | krbtgt |
| 0x200 | 512 | Domain Admins |
| 0x201 | 513 | Domain Users |
| 0x202 | 514 | Domain Guests |