rpcclient

rpcclient -U '' -N TARGET                    # Null session
rpcclient -U 'user%password' TARGET          # With creds
rpcclient -U 'DOMAIN/user%password' TARGET   # Domain creds

rpcclient $> querydominfo
rpcclient $> getdompwinfo                    # Password policy
rpcclient $> enumdomains

rpcclient $> enumdomusers
rpcclient $> queryuser 0x1f4                 # Query by RID
rpcclient $> queryuser administrator
rpcclient $> getusrdompwinfo 0x1f4           # User password info

rpcclient $> enumdomgroups
rpcclient $> querygroup 0x200                # Domain Admins
rpcclient $> querygroupmem 0x200             # Group members
rpcclient $> queryusergroups 0x1f4           # User's groups

rpcclient $> lookupnames administrator
rpcclient $> lookupsids S-1-5-21-DOMAIN-500

for i in $(seq 500 1100); do rpcclient -U '' -N TARGET -c "queryuser 0x$(printf '%x' $i)" 2>/dev/null | grep "User Name"; done

crackmapexec smb TARGET -u '' -p '' --rid-brute
crackmapexec smb TARGET -u 'guest' -p '' --rid-brute

rpcclient $> netshareenum
rpcclient $> netshareenumall
rpcclient $> netsharegetinfo SHARE_NAME

rpcclient $> lsaenumsid
rpcclient $> lookupsids S-1-5-21-...
rpcclient $> lookupnames "Domain Admins"

rpcclient $> enumprinters

rpcclient -U '' -N TARGET -c "enumdomusers"
rpcclient -U '' -N TARGET -c "enumdomgroups"
rpcclient -U 'user%pass' TARGET -c "querygroupmem 0x200"