tools

Overview

rpcclient is a command-line tool for executing RPC (Remote Procedure Call) queries against SMB servers using the MS-RPC protocol. It allows manual interaction with an SMB server to enumerate users, groups, shares, domain info, and other details — often accessible even via null session (anonymous connection). It is part of the Samba suite and is one of the primary tools for SMB reconnaissance during penetration tests.

Target / Context

Windows/Samba SMB servers — both domain and workgroup environments. Effective during null session enumeration when anonymous access is permitted.

Installation

ℹ︎Installation Commands:

Included with Samba:

sudo apt install samba-common-bin

Basic Usage

ℹ︎Basic Usage:

Null session (anonymous):

rpcclient -U "" <target>

Skip password prompt

rpcclient -N -U "" <target>

Authenticated:

rpcclient -U "username%password" <target>

Flags & Options

ℹ︎Flags & Options:
FlagDescriptionExample
-UUsername (use "" for null session)rpcclient -U "" <IP>
-NNo password promptrpcclient -N -U "" <IP>
-cExecute a single command and exitrpcclient -N -U "" <IP> -c “srvinfo”
-dDebug levelrpcclient -d 2 -U "" <IP>

Common Use Cases

Server and Domain Information

ℹ︎Commands:

Server version and OS information

srvinfo

Enumerate deployed domains on the network

enumdomains

Get domain, server, and user info for deployed domains

querydominfo

Share Enumeration

ℹ︎Commands:

List all available shares

netshareenumall

Get details on a specific share

netsharegetinfo <share>

User and Group Enumeration

ℹ︎Commands:

List all domain users (username + RID)

enumdomusers

Get details on a specific user by RID

queryuser <RID>

Get details on a group by RID

querygroup <RID>

List all domain groups

enumdomgroups

List groups a user belongs to

queryusergroups <RID>

RID Brute-Forcing

When you cannot directly enumerate users but can query by RID, iterate through a range to find valid accounts. RIDs for domain users typically start around 500–1100.

ℹ︎Commands: 
for i in $(seq 500 1100); do
  rpcclient -N -U "" <target> -c "queryuser 0x$(printf '%x\n' $i)" \
  | grep "User Name\|user_rid\|group_rid" && echo ""
done

Returns user details only for valid/existing RIDs — all others are silent.

Privilege and Policy Information

ℹ︎Commands:

List available privileges

enumprivs

Get domain password policy info

getdompwinfo

Get password policy for a specific user

getusrdompwinfo <RID>
  • Service Enumeration

References / Images