> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# rpcclient

> rpcclient: RPC enumeration of Active Directory — RID cycling, user/group enum, password policy.

## Connect

```bash theme={"dark"}
rpcclient -U '' -N TARGET                    # Null session
rpcclient -U 'user%password' TARGET          # With creds
rpcclient -U 'DOMAIN/user%password' TARGET   # Domain creds
```

***

## Domain Info

```bash theme={"dark"}
rpcclient $> querydominfo
rpcclient $> getdompwinfo                    # Password policy
rpcclient $> enumdomains
```

***

## User Enumeration

```bash theme={"dark"}
rpcclient $> enumdomusers
rpcclient $> queryuser 0x1f4                 # Query by RID
rpcclient $> queryuser administrator
rpcclient $> getusrdompwinfo 0x1f4           # User password info
```

***

## Group Enumeration

```bash theme={"dark"}
rpcclient $> enumdomgroups
rpcclient $> querygroup 0x200                # Domain Admins
rpcclient $> querygroupmem 0x200             # Group members
rpcclient $> queryusergroups 0x1f4           # User's groups
```

***

## RID Cycling

Enumerate users by brute-forcing RIDs.

```bash theme={"dark"}
rpcclient $> lookupnames administrator
rpcclient $> lookupsids S-1-5-21-DOMAIN-500
```

### Automated

```bash theme={"dark"}
for i in $(seq 500 1100); do rpcclient -U '' -N TARGET -c "queryuser 0x$(printf '%x' $i)" 2>/dev/null | grep "User Name"; done
```

### With CrackMapExec

```bash theme={"dark"}
crackmapexec smb TARGET -u '' -p '' --rid-brute
crackmapexec smb TARGET -u 'guest' -p '' --rid-brute
```

***

## Share Enumeration

```bash theme={"dark"}
rpcclient $> netshareenum
rpcclient $> netshareenumall
rpcclient $> netsharegetinfo SHARE_NAME
```

***

## SID Lookups

```bash theme={"dark"}
rpcclient $> lsaenumsid
rpcclient $> lookupsids S-1-5-21-...
rpcclient $> lookupnames "Domain Admins"
```

***

## Printer Enumeration

```bash theme={"dark"}
rpcclient $> enumprinters
```

***

## One-Liners (Non-Interactive)

```bash theme={"dark"}
rpcclient -U '' -N TARGET -c "enumdomusers"
rpcclient -U '' -N TARGET -c "enumdomgroups"
rpcclient -U 'user%pass' TARGET -c "querygroupmem 0x200"
```

***

## Quick Reference

| Task            | Command                               |
| --------------- | ------------------------------------- |
| Null session    | `rpcclient -U '' -N TARGET`           |
| Users           | `enumdomusers`                        |
| Groups          | `enumdomgroups`                       |
| Domain Admins   | `querygroupmem 0x200`                 |
| RID brute       | `crackmapexec smb TARGET --rid-brute` |
| Password policy | `getdompwinfo`                        |