🖊️ Author: Nairuz Abulhul

🌐 Blog: R3dbuck3t

Table of Contents

Remote Procedure Call (RPC) Overview

<aside> 📌 RPC (Remote Procedure Call) is a protocol that allows programs on different computers to communicate with each other across a network. It provides a way for a client program to call a procedure or function on a remote server, as if it were running locally.

</aside>

Enumeration Checklist

• Null or Anonymous Sessions. If Null sessions are disabled, move to another service and comeback until you get credentials. Then, try again with the creds
• Logins are usually require a username and a password.
• Always RPC to the target if you get username and passwords from other services, RPC might provide additional domain users to use for other attack vectors
• We can use RPC to make changes to the system, such as:
  • Change a user's password.
    • Check Password Reset over RPC (steps below) - You need to authenticate with a user who can reset passwords as an IT or helpdesk team member. You can set any user’s password within the domain with their privileges.
  • Create a new domain user.
  • Create a new shared folder.

What to enumeration with RPC service?

• Enumerate Domain groups
• Enumerate Built-in Groups
• Enumerate Usernames
• Enumerate Built-in groups
• Enumerate Password Policy

RPC Enumeration

RPC Non-Credentialed Enumeration

RPC Credentialed Enumeration