🖊️ Author: Nairuz Abulhul

🌐 Blog: R3dbuck3t

Table of Contents

RPC Client

RPC Authentication with credentials

**rpcclient -U userName IP_Address**

List username

**rpcclient $> enumdomusers**

If you have a username and want to get the user SID number the domain name, use the lookup function

**lookupnames hazard
hazard S-1-5-21-4254423774-1266059056-3197185112-1008 (User: 1)**

Reverse lookup

**rpcclient $> lookupsids S-1-5-21-4254423774-1266059056-3197185112-1008
S-1-5-21-4254423774-1266059056-3197185112-1008 SUPPORTDESK\Hazard (1)**

User Enumeration By RID

rpcclient $> queryuser 0x457

        User Name   :   htb-student
        Full Name   :   Htb Student
        Home Drive  :
        Dir Drive   :
        Profile Path:
        Logon Script:
        Description :
        Workstations:
        Comment     :
        Remote Dial :
        Logon Time               :      Wed, 02 Mar 2022 15:34:32 EST
        Logoff Time              :      Wed, 31 Dec 1969 19:00:00 EST
        Kickoff Time             :      Wed, 13 Sep 30828 22:48:05 EDT
        Password last set Time   :      Wed, 27 Oct 2021 12:26:52 EDT
        Password can change Time :      Thu, 28 Oct 2021 12:26:52 EDT
        Password must change Time:      Wed, 13 Sep 30828 22:48:05 EDT
        unknown_2[0..31]...

Built-in Group

**rpcclient $> enumalsgroups builtin**

Domain Group

**rpcclient $> enumalsgroups domain**