Samba RPC client for executing MS-RPC functions against Windows systems for user, group, domain, and privilege enumeration.
rpcclient -U {username} {target} 🌍 username → user 🌍 target → ip rpcclient -U {username} {target}Sandbox: execFile · Timeout: 60s
security.ad.enum.users security.ad.enum.groups security.ad.enum.domain security.ad.enum.privileges security.ad.rpc.samr security.ad.rpc.lsarpc security.ad.rpc.srvsvc | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
username | string | No | - | Username for RPC authentication | -U, --user, --username |
password | string | No | - | Password for RPC authentication | -P, --password |
no-pass | boolean | No | Null session (no password) | -N, --no-pass | |
workgroup | string | No | WORKGROUP | Workgroup or domain name | -W, --workgroup |
ip | string | No | - | Target IP address | -I, --ip |
port | integer | No | 445 | SMB/RPC port number | -p, --port |
debug | integer | No | 0 | Debug level (0-10) | -d, --debug |
command | string | No | - | Execute RPC command non-interactively | -c, --command |
auth-file | file | No | - | File containing credentials | -A, --auth-file |
timeout | integer | No | 30 | Connection timeout in seconds | -t, --timeout |
kerberos | boolean | No | Use Kerberos authentication | -k, --kerberos | |
encrypt | boolean | No | Require SMB encryption | -e, --encrypt | |
auth_file | boolean | No | - | Credentials file | --auth-file |
s | boolean | No | - | Config file path | -s, --config |
Inputs
network.target.ip Target IP or hostname
credential.username Username for RPC authentication
credential.password Password for RPC authentication
Outputs
security.ad.enum.users List of domain/local users with RIDs
security.ad.enum.groups Group membership information
security.ad.enum.domain Domain and trust information
network_traffic Produces
security.ad.enum.userssecurity.ad.enum.groupssecurity.ad.enum.domainConsumes
network.target.ipcredential.usernamecredential.password| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Null session connection to a domain controller
rpcclient -U "" -N 10.10.10.1Enumerate domain users via SAMR
rpcclient -U jdoe 10.10.10.1 -c "enumdomusers"Enumerate domain groups
rpcclient -U jdoe 10.10.10.1 -c "enumdomgroups"Get user information by RID
rpcclient -U jdoe 10.10.10.1 -c "queryuser 500"Enumerate SID for a domain user
rpcclient -U jdoe 10.10.10.1 -c "lookupsids S-1-5-21-..."List shares via SRVSVC
rpcclient -U jdoe 10.10.10.1 -c "netshareenumall"Get domain password policy
rpcclient -U jdoe 10.10.10.1 -c "getdompwinfo"rpcclient is a command-line MS-RPC client from the Samba suite that allows direct interaction with Windows RPC services including SAMR (Security Account Manager), LSA (Local Security Authority), and SRVSVC (Server Service).
| Category | Command | Description |
|---|---|---|
| Users | enumdomusers |
List all domain users |
| Users | queryuser <rid> |
Get detailed user info |
| Users | queryuser <rid> --sid |
Get user SID |
| Groups | enumdomgroups |
List all domain groups |
| Groups | querygroup <rid> |
Get group members |
| Domain | lsaquery |
Get domain info |
| Domain | getdompwinfo |
Get password policy |
| Shares | netshareenumall |
List all shares |
| Shares | netsharegetinfo <share> |
Get share details |
| SID | lookupsids <sid> |
Resolve SID to name |
| SID | lookupnames <name> |
Resolve name to SID |
rpcclient -U "" -N <target>rpcclient -U guest%"" <target>rpcclient -U user%pass <target>rpcclient -k -U user@DOMAIN <target>