> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/services/135-rpc.md).

# (135) RPC

<details>

<summary>RPCCLIENT</summary>

<pre class="language-bash"><code class="lang-bash">rpcclient -W '' -c querydispinfo -U''%'' '192.168.231.175'
#index: 0xeda RID: 0x1f4 acb: 0x00000210 Account: Administrator	Name: (null)	Desc: Built-in account for administering the computer/domain
#index: 0xf72 RID: 0x457 acb: 0x00020010 Account: D.Durant	Name: (null)	Desc: Linear Algebra and crypto god
#index: 0xf73 RID: 0x458 acb: 0x00020010 Account: G.Goldberg	Name: (null)	Desc: Blockchain expert
#index: 0xedb RID: 0x1f5 acb: 0x00000215 Account: Guest	Name: (null)	Desc: Built-in account for guest access to the computer/domain
#index: 0xf6d RID: 0x452 acb: 0x00020010 Account: J.Johnson	Name: (null)	Desc: Networking specialist
#index: 0xf6b RID: 0x450 acb: 0x00020010 Account: K.Keen	Name: (null)	Desc: Frontend Developer
#index: 0xf10 RID: 0x1f6 acb: 0x00020011 Account: krbtgt	Name: (null)	Desc: Key Distribution Center Service Account
#index: 0xf6c RID: 0x451 acb: 0x00000210 Account: L.Livingstone	Name: (null)	Desc: SysAdmin
#index: 0xf6a RID: 0x44f acb: 0x00020010 Account: M.Mason	Name: (null)	Desc: Ex IT admin
#index: 0xf70 RID: 0x455 acb: 0x00020010 Account: P.Parker	Name: (null)	Desc: Backend Developer
#index: 0xf71 RID: 0x456 acb: 0x00020010 Account: R.Robinson	Name: (null)	Desc: Database Admin
<strong>#index: 0xf6f RID: 0x454 acb: 0x00020010 Account: S.Swanson	Name: (null)	Desc: Military Vet now cybersecurity specialist
</strong>#index: 0xf6e RID: 0x453 acb: 0x00000210 Account: V.Ventz	Name: (null)	Desc: New-hired, reminder: HotelCalifornia194!
</code></pre>

</details>

<details>

<summary>Users Enumeration</summary>

### Save usernames into users.txt

```bash
rpcclient -U "" -N 10.10.10.161
rpcclient $> enumdomusers
# user:[Administrator] rid:[0x1f4]
# user:[Guest] rid:[0x1f5]
# user:[krbtgt] rid:[0x1f6]
# user:[DefaultAccount] rid:[0x1f7]
# user:[sebastien] rid:[0x479]
# user:[lucinda] rid:[0x47a]
# user:[svc-alfresco] rid:[0x47b]
# user:[andy] rid:[0x47e]
# user:[mark] rid:[0x47f]
# user:[santi] rid:[0x480]
```

### Sanitize users

```bash
cat users.txt| cut -d " " -f 1 | cut -d ":" -f 2 | sed 's/[][]//g' > cleaned_users.txt
```

</details>

<details>

<summary>Group Enumeration</summary>

<pre class="language-bash"><code class="lang-bash">rpcclient -U "" -N 10.10.10.161
rpcclient $> enumdomgroups
# group:[Enterprise Read-only Domain Controllers] rid:[0x1f2]
# group:[Domain Admins] rid:[0x200]
# group:[Domain Users] rid:[0x201]
# group:[Domain Guests] rid:[0x202]
# group:[Domain Computers] rid:[0x203]
# group:[Domain Controllers] rid:[0x204]
# group:[Schema Admins] rid:[0x206]
rpcclient $> querygroup 0x200
#	Group Name:	Domain Admins
<strong>#	Description:	Designated administrators of the domain
</strong>#	Group Attribute:7
#	Num Members:1
	
rpcclient $> querygroupmem 0x200
#	rid:[0x1f4] attr:[0x7]
	
rpcclient $> queryuser 0x1f4
#	User Name   :	Administrator
#	Full Name   :	Administrator
#	Home Drive  :	
#	Dir Drive   :	
#	Profile Path:	
#	Logon Script:	
#	Description :	Built-in account for administering the computer/domain
#Workstations:	
</code></pre>

</details>