> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/rpc-discovery/rpcclient.md). # rpcclient Tool for executing client side MS-RPC functions. This tool is part of the samba suite. ## Connect ### With Null session To connect as an anonymous Null-session with a password (`-N`) ```bash rpcclient -U '' -N $TARGET_IP ``` This is normally **not** allowed! If the connection was successful, you get a prompt ```bash ┌──(kali㉿kali)-[/mnt/hgfs/Wargames/TryHackMe] └─$ rpcclient -U '' -N $TARGET_IP rpcclient $> ``` ### With credentials To connect with domain credentials ```bash rpcclient -U domain.local/user%'Password' $TARGET_IP ``` To connect with credentials such as `Administrator:secret_pw` ```bash rpcclient -U Administrator --password=sercet_pw $TARGET_IP ``` ## Enumeration ### Domain Information To query domain info via [SAMR](https://learn.microsoft.com/en-us/openspecs/windows_protocols/MS-SAMR/4df07fab-1bbc-452f-8e92-7853a3c7e380) ```bash rpcclient -U domain.local/user%'Password' $TARGET_IP -c querydominfo ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ rpcclient -U corp.com/jeff%'HenchmanPutridBonbon11' $TARGET_IP -c querydominfo Domain: CORP Server: Comment: Total Users: 49 Total Groups: 0 Total Aliases: 19 Sequence No: 1 Force Logoff: -1 Domain Server State: 0x1 Server Role: ROLE_DOMAIN_PDC Unknown 3: 0x0 ```
To enumerate domains via [SAMR](https://learn.microsoft.com/en-us/openspecs/windows_protocols/MS-SAMR/4df07fab-1bbc-452f-8e92-7853a3c7e380) ```bash rpcclient -U domain.local/user%'Password' $TARGET_IP -c enumdomains ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ rpcclient -U corp.com/jeff%'HenchmanPutridBonbon11' $TARGET_IP -c enumdomains name:[CORP] idx:[0x0] name:[Builtin] idx:[0x0] ```
### User Enumeration To enumerate domain users via [SAMR](https://learn.microsoft.com/en-us/openspecs/windows_protocols/MS-SAMR/4df07fab-1bbc-452f-8e92-7853a3c7e380) ```bash rpcclient -U domain.local/user%'Password' $TARGET_IP -c enumdomusers ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ rpcclient -U corp.com/jeff%'HenchmanPutridBonbon11' $TARGET_IP -c enumdomusers user:[Administrator] rid:[0x1f4] user:[Guest] rid:[0x1f5] user:[krbtgt] rid:[0x1f6] user:[dave] rid:[0x44f] user:[stephanie] rid:[0x450] user:[jeff] rid:[0x451] user:[jeffadmin] rid:[0x452] user:[iis_service] rid:[0x455] user:[pete] rid:[0x463] user:[jen] rid:[0x464] ```
To get information on a specific user, specified by the RID ```bash queryuser ```
Example run ```bash rpcclient $> queryuser 1008 User Name : DC$ Full Name : Home Drive : Dir Drive : Profile Path: Logon Script: Description : Workstations: Comment : Remote Dial : Logon Time : Tue, 17 Mar 2026 17:03:56 CET Logoff Time : Thu, 01 Jan 1970 01:00:00 CET Kickoff Time : Thu, 14 Sep 30828 04:48:05 CEST Password last set Time : Tue, 17 Mar 2026 16:34:20 CET Password can change Time : Wed, 18 Mar 2026 16:34:20 CET Password must change Time: Thu, 14 Sep 30828 04:48:05 CEST unknown_2[0..31]... user_rid : 0x3f0 group_rid: 0x204 acb_info : 0x00002100 fields_present: 0x00ffffff logon_divs: 168 bad_password_count: 0x00000000 logon_count: 0x000000de padding1[0..7]... logon_hrs[0..21]... rpcclient $> ```
### RID Cycling In Active Directory, RID (Relative Identifier) ranges are used to assign unique identifiers to user and group objects. These RIDs are components of the Security Identifier (SID), which uniquely identifies each object within a domain. Certain RIDs are well-known and standardized. **500** is the Administrator account, **501** is the Guest account and **512-514** are for the following groups: Domain Admins, Domain users and Domain guests. User accounts typically start from RID **1000** onwards. #### User RID Cycling "Full" RID enumeration, RID 500-2000 ```bash for i in $(seq 500 2000); do echo "queryuser $i" | rpcclient -U '' -N $TARGET_IP 2>/dev/null | grep -iE "User Name|user_rid|Full Name"; done ``` This will take **several minutes** to complete!
Example run ```bash ┌──(kali㉿kali)-[~] └─$ for i in $(seq 500 2000); do echo "queryuser $i" | rpcclient -U '' -N $TARGET_IP 2>/dev/null | grep -iE "User Name|user_rid|Full Name"; done User Name : Administrator Full Name : user_rid : 0x1f4 User Name : Guest Full Name : user_rid : 0x1f5 User Name : krbtgt Full Name : user_rid : 0x1f6 User Name : DC$ Full Name : user_rid : 0x3f0 User Name : WRK$ Full Name : user_rid : 0x457 User Name : sshd Full Name : sshd user_rid : 0x649 User Name : gerald.burgess Full Name : Gerald Burgess user_rid : 0x650 User Name : nigel.parsons Full Name : Nigel Parsons user_rid : 0x651 User Name : guy.smith Full Name : Guy Smith user_rid : 0x652 User Name : jeremy.booth Full Name : Jeremy Booth user_rid : 0x653 User Name : barbara.jones Full Name : Barbara Jones user_rid : 0x654 User Name : marion.kay Full Name : Marion Kay user_rid : 0x655 User Name : kathryn.williams Full Name : Kathryn Williams user_rid : 0x656 User Name : danny.baker Full Name : Danny Baker user_rid : 0x657 User Name : gary.clarke Full Name : Gary Clarke user_rid : 0x658 User Name : daniel.turner Full Name : Daniel Turner user_rid : 0x659 User Name : debra.yates Full Name : Debra Yates user_rid : 0x65a User Name : jeffrey.thompson Full Name : Jeffrey Thompson user_rid : 0x65b User Name : martin.riley Full Name : Martin Riley user_rid : 0x65c <---snip---> ```
Enumeration of user accounts (names only), RID 1000-2000 (0x3e8-0x7d0) ```bash for i in $(seq 1000 2000); do echo "queryuser $i" | rpcclient -U '' -N $TARGET_IP 2>/dev/null | grep -iE "User Name"; done ``` This will take **several minutes** to complete!
Example run ```bash ┌──(kali㉿kali)-[~] └─$ for i in $(seq 1000 2000); do echo "queryuser $i" | rpcclient -U '' -N $TARGET_IP 2>/dev/null | grep -iE "User Name"; done User Name : DC$ User Name : WRK$ User Name : sshd User Name : gerald.burgess User Name : nigel.parsons User Name : guy.smith User Name : jeremy.booth User Name : barbara.jones User Name : marion.kay User Name : kathryn.williams User Name : danny.baker User Name : gary.clarke User Name : daniel.turner User Name : debra.yates User Name : jeffrey.thompson User Name : martin.riley User Name : danielle.lee User Name : douglas.roberts User Name : dawn.bolton User Name : danielle.ali User Name : michelle.palmer User Name : katie.thomas User Name : jennifer.harding User Name : strategos User Name : empanadal0v3r User Name : drgonz0 User Name : strate905 User Name : krbtgtsvc User Name : asrepuser1 ```
### Group Enumeration To enumerate domain groups with SAMR ```bash enumdomgroups ```
Example run ```bash rpcclient $> enumdomgroups group:[Enterprise Read-only Domain Controllers] rid:[0x1f2] group:[Domain Admins] rid:[0x200] group:[Domain Users] rid:[0x201] group:[Domain Guests] rid:[0x202] group:[Domain Computers] rid:[0x203] group:[Domain Controllers] rid:[0x204] group:[Schema Admins] rid:[0x206] group:[Enterprise Admins] rid:[0x207] group:[Group Policy Creator Owners] rid:[0x208] group:[Read-only Domain Controllers] rid:[0x209] group:[Cloneable Domain Controllers] rid:[0x20a] group:[Protected Users] rid:[0x20d] group:[Key Admins] rid:[0x20e] group:[Enterprise Key Admins] rid:[0x20f] group:[DnsUpdateProxy] rid:[0x456] group:[Tier 2 Admins] rid:[0x64a] group:[Tier 1 Admins] rid:[0x64b] group:[Tier 0 Admins] rid:[0x64c] group:[HR Share RW] rid:[0x64d] group:[Internet Access] rid:[0x64e] group:[Server Admins] rid:[0x64f] rpcclient $> ```
## Usage information
rpcclient --help ```bash ┌──(kali㉿kali)-[~] └─$ rpcclient --help Usage: rpcclient [OPTION...] BINDING-STRING|HOST Options: -c, --command=COMMANDS Execute semicolon separated cmds -I, --dest-ip=IP Specify destination IP address -p, --port=PORT Specify port number Help options: -?, --help Show this help message --usage Display brief usage message Common Samba options: -d, --debuglevel=DEBUGLEVEL Set debug level --debug-stdout Send debug output to standard output -s, --configfile=CONFIGFILE Use alternative configuration file --option=name=value Set smb.conf option from command line -l, --log-basename=LOGFILEBASE Basename for log/debug files --leak-report enable talloc leak reporting on exit --leak-report-full enable full talloc leak reporting on exit Connection options: -R, --name-resolve=NAME-RESOLVE-ORDER Use these name resolution services only -O, --socket-options=SOCKETOPTIONS socket options to use -m, --max-protocol=MAXPROTOCOL Set max protocol level -n, --netbiosname=NETBIOSNAME Primary netbios name --netbios-scope=SCOPE Use this Netbios scope -W, --workgroup=WORKGROUP Set the workgroup name --realm=REALM Set the realm name Credential options: -U, --user=[DOMAIN/]USERNAME[%PASSWORD] Set the network username -N, --no-pass Don't ask for a password --password=STRING Password --pw-nt-hash The supplied password is the NT hash -A, --authentication-file=FILE Get the credentials from a file -P, --machine-pass Use stored machine account password --simple-bind-dn=DN DN to use for a simple bind --use-kerberos=desired|required|off Use Kerberos authentication --use-krb5-ccache=CCACHE Credentials cache location for Kerberos --use-winbind-ccache Use the winbind ccache for authentication --client-protection=sign|encrypt|off Configure used protection for client connections Deprecated legacy options: -k, --kerberos DEPRECATED: Migrate to --use-kerberos Version options: -V, --version Print version ```
help within rpcclient ```bash rpcclient $> help --------------- ---------------------- UNIXINFO getpwuid Get shell and homedir uidtosid Convert uid to sid --------------- ---------------------- MDSSVC fetch_properties Fetch connection properties fetch_attributes Fetch attributes for a CNID --------------- ---------------------- CLUSAPI clusapi_open_cluster Open cluster clusapi_get_cluster_name Get cluster name clusapi_get_cluster_version Get cluster version clusapi_get_quorum_resource Get quorum resource clusapi_create_enum Create enum query clusapi_create_enumex Create enumex query clusapi_open_resource Open cluster resource clusapi_online_resource Set cluster resource online clusapi_offline_resource Set cluster resource offline clusapi_get_resource_state Get cluster resource state clusapi_get_cluster_version2 Get cluster version2 clusapi_pause_node Pause cluster node clusapi_resume_node Resume cluster node --------------- ---------------------- WITNESS GetInterfaceList List the interfaces to which witness client connections can be made Register Register for resource state change notifications of a NetName and IPAddress UnRegister Unregister for notifications from the server AsyncNotify Request notification of registered resource changes from the server RegisterEx Register for resource state change notifications of a NetName, ShareName and multiple IPAddresses --------------- ---------------------- FSRVP fss_is_path_sup Check whether a share supports shadow-copy requests fss_get_sup_version Get supported FSRVP version from server fss_create_expose Request shadow-copy creation and exposure fss_delete Request shadow-copy share deletion fss_has_shadow_copy Check for an associated share shadow-copy fss_get_mapping Get shadow-copy share mapping information fss_recovery_complete Flag read-write snapshot as recovery complete, allowing further shadow-copy requests --------------- ---------------------- WINREG winreg_enumkey Enumerate Keys querymultiplevalues Query multiple values querymultiplevalues2 Query multiple values winreg_enumval Enumerate Values --------------- ---------------------- EVENTLOG eventlog_readlog Read Eventlog eventlog_numrecord Get number of records eventlog_oldestrecord Get oldest record eventlog_reportevent Report event eventlog_reporteventsource Report event and source eventlog_registerevsource Register event source eventlog_backuplog Backup Eventlog File eventlog_loginfo Get Eventlog Information --------------- ---------------------- DRSUAPI dscracknames Crack Name dsgetdcinfo Get Domain Controller Info dsgetncchanges Get NC Changes dswriteaccountspn Write Account SPN --------------- ---------------------- NTSVCS ntsvcs_getversion Query NTSVCS version ntsvcs_validatedevinst Query NTSVCS device instance ntsvcs_hwprofflags Query NTSVCS HW prof flags ntsvcs_hwprofinfo Query NTSVCS HW prof info ntsvcs_getdevregprop Query NTSVCS device registry property ntsvcs_getdevlistsize Query NTSVCS device list size ntsvcs_getdevlist Query NTSVCS device list --------------- ---------------------- WKSSVC wkssvc_wkstagetinfo Query WKSSVC Workstation Information wkssvc_getjoininformation Query WKSSVC Join Information wkssvc_messagebuffersend Send WKSSVC message wkssvc_enumeratecomputernames Enumerate WKSSVC computer names wkssvc_enumerateusers Enumerate WKSSVC users --------------- ---------------------- SHUTDOWN --------------- ---------------------- EPMAPPER epmmap Map a binding epmlookup Lookup bindings --------------- ---------------------- ECHO echoaddone Add one to a number echodata Echo data sinkdata Sink data sourcedata Source data --------------- ---------------------- DFS dfsversion Query DFS support dfsadd Add a DFS share dfsremove Remove a DFS share dfsgetinfo Query DFS share info dfsenum Enumerate dfs shares dfsenumex Enumerate dfs shares --------------- ---------------------- SRVSVC srvinfo Server query info netshareenum Enumerate shares netshareenumall Enumerate all shares netsharegetinfo Get Share Info netsharesetinfo Set Share Info netsharesetdfsflags Set DFS flags netfileenum Enumerate open files netremotetod Fetch remote time of day netnamevalidate Validate sharename netfilegetsec Get File security netsessdel Delete Session netsessenum Enumerate Sessions netdiskenum Enumerate Disks netconnenum Enumerate Connections netshareadd Add share netsharedel Delete share --------------- ---------------------- NETLOGON logonctrl2 Logon Control 2 getanydcname Get trusted DC name getdcname Get trusted PDC name dsr_getdcname Get trusted DC name dsr_getdcnameex Get trusted DC name dsr_getdcnameex2 Get trusted DC name dsr_getsitename Get sitename dsr_getforesttrustinfo Get Forest Trust Info logonctrl Logon Control samlogon Sam Logon change_trust_pw Change Trust Account Password gettrustrid Get trust rid dsr_enumtrustdom Enumerate trusted domains dsenumdomtrusts Enumerate all trusted domains in an AD forest deregisterdnsrecords Deregister DNS records netrenumtrusteddomains Enumerate trusted domains netrenumtrusteddomainsex Enumerate trusted domains getdcsitecoverage Get the Site-Coverage from a DC capabilities Return Capabilities logongetdomaininfo Return LogonGetDomainInfo --------------- ---------------------- IRemoteWinspool winspool_AsyncOpenPrinter Open printer handle winspool_AsyncCorePrinterDriverInstalled Query Core Printer Driver Installed --------------- ---------------------- SPOOLSS adddriver Add a print driver addprinter Add a printer deldriver Delete a printer driver deldriverex Delete a printer driver with files enumdata Enumerate printer data enumdataex Enumerate printer data for a key enumkey Enumerate printer keys enumjobs Enumerate print jobs getjob Get print job setjob Set print job enumports Enumerate printer ports enumdrivers Enumerate installed printer drivers enumprinters Enumerate printers getdata Get print driver data getdataex Get printer driver data with keyname getdriver Get print driver information getdriverdir Get print driver upload directory getdriverpackagepath Get print driver package download directory getprinter Get printer info openprinter Open printer handle openprinter_ex Open printer handle setdriver Set printer driver getprintprocdir Get print processor directory addform Add form setform Set form getform Get form deleteform Delete form enumforms Enumerate forms setprinter Set printer comment setprintername Set printername setprinterdata Set REG_SZ printer data rffpcnex Rffpcnex test printercmp Printer comparison test enumprocs Enumerate Print Processors enumprocdatatypes Enumerate Print Processor Data Types enummonitors Enumerate Print Monitors createprinteric Create Printer IC playgdiscriptonprinteric Create Printer IC getcoreprinterdrivers Get CorePrinterDriver enumpermachineconnections Enumerate Per Machine Connections addpermachineconnection Add Per Machine Connection delpermachineconnection Delete Per Machine Connection --------------- ---------------------- SAMR queryuser Query user info querygroup Query group info queryusergroups Query user groups queryuseraliases Query user aliases querygroupmem Query group membership queryaliasmem Query alias membership queryaliasinfo Query alias info deletealias Delete an alias querydispinfo Query display info querydispinfo2 Query display info querydispinfo3 Query display info querydominfo Query domain info enumdomusers Enumerate domain users enumdomgroups Enumerate domain groups enumalsgroups Enumerate alias groups enumdomains Enumerate domains createdomuser Create domain user createdomgroup Create domain group createdomalias Create domain alias samlookupnames Look up names samlookuprids Look up names deletedomgroup Delete domain group deletedomuser Delete domain user samquerysecobj Query SAMR security object getdompwinfo Retrieve domain password info getusrdompwinfo Retrieve user domain password info lookupdomain Lookup Domain Name chgpasswd Change user password chgpasswd2 Change user password chgpasswd3 Change user password chgpasswd4 Change user password getdispinfoidx Get Display Information Index setuserinfo Set user info setuserinfo2 Set user info2 --------------- ---------------------- LSARPC-DS dsroledominfo Get Primary Domain Information --------------- ---------------------- LSARPC lsaquery Query info policy lookupsids Convert SIDs to names lookupsids3 Convert SIDs to names lookupsids_level Convert SIDs to names lookupnames Convert names to SIDs lookupnames4 Convert names to SIDs lookupnames_level Convert names to SIDs enumtrust Enumerate trusted domains enumprivs Enumerate privileges getdispname Get the privilege name lsaenumsid Enumerate the LSA SIDS lsacreateaccount Create a new lsa account lsaenumprivsaccount Enumerate the privileges of an SID lsaenumacctrights Enumerate the rights of an SID lsaaddpriv Assign a privilege to a SID lsadelpriv Revoke a privilege from a SID lsaaddacctrights Add rights to an account lsaremoveacctrights Remove rights from an account lsalookupprivvalue Get a privilege value given its name lsaquerysecobj Query LSA security object lsaquerytrustdominfo Query LSA trusted domains info (given a SID) lsaquerytrustdominfobyname Query LSA trusted domains info (given a name), only works for Windows > 2k lsaquerytrustdominfobysid Query LSA trusted domains info (given a SID) lsasettrustdominfo Set LSA trusted domain info getusername Get username createsecret Create Secret deletesecret Delete Secret querysecret Query Secret setsecret Set Secret retrieveprivatedata Retrieve Private Data storeprivatedata Store Private Data createtrustdom Create Trusted Domain createtrustdomex2 Create Trusted Domain (Ex2 Variant) createtrustdomex3 Create Trusted Domain (Ex3 Variant) deletetrustdom Delete Trusted Domain --------------- ---------------------- GENERAL OPTIONS help Get help on commands ? Get help on commands debuglevel Set debug level debug Set debug level list List available commands on exit Exit program quit Exit program sign Force RPC pipe connections to be signed seal Force RPC pipe connections to be sealed packet Force RPC pipe connections with packet authentication level schannel Force RPC pipe connections to be sealed with 'schannel'. Assumes valid machine account to this domain controller. schannelsign Force RPC pipe connections to be signed (not sealed) with 'schannel'. Assumes valid machine account to this domain controller. timeout Set timeout (in milliseconds) for RPC operations transport Choose ncacn transport for RPC operations none Force RPC pipe connections to have no special properties rpcclient $> ```
## Resources rpcclient - Linux manual page: