Testing the Microsoft RPC (MSRPC / DCE-RPC) endpoint mapper and exposed RPC interfaces during authorized engagements. The endpoint mapper listens on TCP/UDP 135 (also reachable over SMB named pipes on 139/445 and HTTP on 593). Covers endpoint enumeration with rpcdump, IFID-to-named-pipe mapping (lsarpc, samr, svcctl, atsvc), DCOM command execution, IOXIDResolver interface discovery, and RPC interface fuzzing.
Instrucciones de origen · Vista previa de solo lectura
name
pentesting-msrpc
description
Testing the Microsoft RPC (MSRPC / DCE-RPC) endpoint mapper and exposed RPC interfaces during authorized engagements. The endpoint mapper listens on TCP/UDP 135 (also reachable over SMB named pipes on 139/445 and HTTP on 593). Covers endpoint enumeration with rpcdump, IFID-to-named-pipe mapping (lsarpc, samr, svcctl, atsvc), DCOM command execution, IOXIDResolver interface discovery, and RPC interface fuzzing.
During authorized Windows/AD assessments when TCP 135 (or 593, or RPC over SMB on 139/445) is open
When mapping which RPC services and named pipes a host exposes (LSA, SAMR, Task Scheduler, Service Control)
When you have valid credentials and want remote code execution via DCOM (dcomexec)
When enumerating network interfaces/IPv6 addresses without authentication via IOXIDResolver
When researching RPC interface attack surface (fuzzing) on an isolated test host
Quick Enumeration
# Dump RPC endpoints registered with the endpoint mapper (135)
rpcdump.py <IP> -p 135
rpcdump.py -port 135 [[domain/]username[:password]@]<IP>
# Map endpoints reachable over SMB named pipes / other transports
rpcdump.py -port 139 [[domain/]username[:password]@]<IP>
rpcdump.py -port 445 [[domain/]username[:password]@]<IP>
# Metasploit DCERPC scanners (all target port 135 except tcp_dcerpc_auditor)
msf> use auxiliary/scanner/dcerpc/endpoint_mapper
msf> use auxiliary/scanner/dcerpc/hidden
msf> use auxiliary/scanner/dcerpc/management
msf> use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor
Critical: Checks Most Often Missed
Endpoint mapper exposes the dynamic port range — rpcdump.py reveals IFID values, the named pipe, and the binding (ncacn_ip_tcp, ncadg_ip_udp, ncacn_np, ncacn_http). Each IFID maps to a high-value service.
Named-pipe interfaces of interest:
\pipe\lsarpc (LSA) — enumerate users
\pipe\samr (SAMR) — read SAM elements and brute-force users regardless of account lockout policy
\pipe\winreg (Remote Registry) — read/modify the registry
\pipe\epmapper (DCOM) — info gathering and password grinding
IOXIDResolver unauthenticated enumeration — the ServerAlive2 method in the IOXIDResolver interface leaks all network interfaces (including IPv6) with no auth.
DCOM RCE with valid creds — executes commands via DCOM objects (ShellWindows, ShellBrowserWindow, MMC20).
dcomexec.py
MS-EVEN / CVE-2025-29969 (EventLog-in) — a TOCTOU flaw in the MS-EVEN interface (\pipe\even) lets an authenticated low-privileged user trigger a remote arbitrary file write; it also exposes a file-existence probe primitive.
How to CONFIRM: MSRPC is confirmed when rpcdump.py <IP> -p 135 returns one or more IFID entries with bindings. The presence of \pipe\samr confirms SAMR-based user enumeration is possible; \pipe\svcctl/\pipe\atsvc confirm remote-exec primitives (with creds).
Workflow
Step 1: Enumerate RPC endpoints and interfaces
# Primary endpoint discovery
rpcdump.py <IP> -p 135
# Sample output line:# IFID: 12345778-1234-abcd-ef00-0123456789ac version 1.0# Named Pipe: \pipe\samr (LSA SAMR interface)# Binding: ncacn_np:<IP>[\pipe\samr]# Enumerate over alternate transports if 135 is filtered
rpcdump.py -port 445 [[domain/]username[:password]@]<IP>
# Identify exposed RPC services with Metasploit
msf> use auxiliary/scanner/dcerpc/endpoint_mapper
msf> set rhosts <IP>
msf> run
rpcdump.py <IP> -p 135 lists \pipe\samr, \pipe\svcctl, and \pipe\atsvc, confirming the host exposes user-enumeration and remote-exec interfaces for later credentialed abuse.
Scenario 2: IPv6 Disclosure
On a dual-stack host, IOXIDResolver's ServerAlive2 leaks an internal IPv6 address unauthenticated, opening an IPv6 path that bypasses IPv4 ACLs.
Scenario 3: DCOM Lateral Movement
With a captured local admin hash, dcomexec.py -object MMC20 -hashes :<hash> administrator@<IP> yields a semi-interactive shell without creating a new service.
Scenario 4: Account-Lockout-Safe Enumeration
SAMR over \pipe\samr enumerates all domain users without incrementing the bad-password counter, providing a clean user list for spraying elsewhere.
Output Format
## MSRPC Finding
**Service**: Microsoft RPC (DCE-RPC)
**Severity**: <Critical|High|Medium|Informational>
**Host**: <IP>:135 (also 139/445/593 as applicable)
### Summary
<What was found: exposed interfaces, IOXIDResolver leak, DCOM RCE, CVE-2025-29969>
### Exposed Interfaces
| IFID | Named Pipe | Description | Risk |
|------|-----------|-------------|------|
| 12345778-1234-abcd-ef00-0123456789ac | \pipe\samr | SAMR user enum | Lockout-safe grinding |
| 367abb81-9844-35f1-ad32-98f038001003 | \pipe\svcctl | Service control | Remote exec (creds) |
### Evidence
- Command: rpcdump.py <IP> -p 135
- Output: <IFID/binding excerpt>
### Recommendation
1. Restrict access to TCP 135 and the dynamic RPC port range at the firewall
2. Limit RPC over SMB named pipes to trusted management hosts
3. Apply patches for known RPC CVEs (e.g. CVE-2025-29969 / MS-EVEN)
4. Enforce strong credentials to limit DCOM/SAMR abuse impact
