rpcclient: MS-RPC over SMB
Query domain users, groups and SIDs directly over the SMB-hosted RPC interface.
bash·1 min read··INE Certification
rpcclient implements MS-RPC (Microsoft’s RPC implementation, tunneled over SMB). It’s a useful second angle on a Windows/Samba target when share-level tools like smbclient don’t give you enough, particularly for domain user/group enumeration.
Null session
rpcclient -U "" -N <target_ip> # anonymous/null sessionCommands once connected
enumdomusers # enumerate domain users
enumdomgroups # enumerate domain groups
lookupnames <username> # resolve a username to its SIDRelated
- SMB & NetBIOS enumeration: the full workflow these tools plug into
- enum4linux: wraps rpcclient and friends in one run
- smbmap: share permissions
- SMB exploitation: using the users you find