rpcclient — RPC Enumeration Reference

Ctrl+F: rpcclient · enumdomusers · null session · -U "" -N · RID · lsaquery

External: Internal All The Things — Enumeration

What is rpcclient?

rpcclient is part of the Samba suite and provides a command-line interface for sending raw Microsoft Remote Procedure Call (MS-RPC) requests over SMB (port 445). It allows low-level enumeration of users, groups, SIDs, password policies, shares, printers, and domain info — including via null sessions on misconfigured systems.

OSCP use: Use rpcclient when enum4linux doesn’t give enough detail, or when you want to enumerate users/SIDs manually. The lookupsids and enumdomusers commands are especially useful for building user lists.

Install (Kali)

sudo apt update && sudo apt install -y samba-common-bin
which rpcclient
rpcclient --version

Part of Samba — same package as smbclient, enum4linux-ng dependencies.

→ Installation - Kali Setup

📌 OSCP workflow — null session + enumdomusers

rpcclient -U '' -N $IP

At the rpcclient $> prompt:

enumdomusers

One-liner (no interactive shell):

rpcclient -U '' -N 192.168.234.165 -c "enumdomusers"
rpcclient -U "" -N $IP -c "enumdomusers" | tee rpc_users.txt

Automate enumdomusers → queryuser every RID (Description/Comment password hunt) → rpcclient - queryuser RID Enumeration

Parse usernames for spray / Kerberos

rpcclient -U "" -N $IP -c "enumdomusers" | grep -oP '\[\K[^]]+(?=\])' | cut -d: -f1 | sort -u > users.txt

# Or awk on "user:[name]" format:
rpcclient -U "" -N $IP -c "enumdomusers" | awk -F'[\\[\\]]' '{print $2}' | cut -d: -f1 > users.txt

→ Hydra · Kerberoast · Kerbrute · CrackMapExec - nxc

Syntax

rpcclient [options] TARGET

📌 1) Connection Flags

Flag	Description
`-U <user>`	Username (use `-U ""` or `-U "%"` for null session)
`-U <user%pass>`	Username and password inline
`-N`	No password / null session
`-W <domain>`	Workgroup / domain
`-p <port>`	Port (default: 445)
`-I <ip>`	Force connection to specific IP
`-c "<cmd>"`	Execute a single command non-interactively
`-d <level>`	Debug level
`--pw-nt-hash`	Use NT hash as the password (pass-the-hash)
`-k`	Kerberos authentication

📌 2) Connecting

# Null session (anonymous) — OSCP default try
rpcclient -U '' -N $IP
rpcclient -U "" -N 10.10.10.10
rpcclient -U "%" 10.10.10.10
 
# With credentials
rpcclient -U admin%password 10.10.10.10
 
# Domain account
rpcclient -U DOMAIN/user%password 10.10.10.10

Once connected, you get an interactive prompt:

rpcclient $>

📌 3) User Enumeration

# List all domain users
enumdomusers
 
# Get detailed info on a specific user
queryuser <RID>
queryuser 0x1f4          # 0x1f4 = 500 decimal (Administrator)
queryuser 0x3e9          # 0x3e9 = 1001
 
**Bulk dump every user by RID** (scripts, grep Description/Comment) → **[[rpcclient - queryuser RID Enumeration]]**
 
# Get user info by name
queryuser username
 
# Enumerate user privileges
enumprivs
 
# Look up a username → SID
lookupnames administrator
lookupnames "Domain Admins"
 
# Look up a SID → name
lookupsids S-1-5-21-XXXXXXXX-XXXXXXXX-XXXXXXXX-500

📌 4) Group Enumeration

# List all domain groups
enumdomgroups
 
# List local groups
enumalsgroups domain
enumalsgroups builtin
 
# Get members of a specific group (by RID)
querygroup <RID>
querygroupmem <RID>
 
# Get members of Domain Admins
querygroup 0x200
querygroupmem 0x200

📌 5) RID Cycling — Enumerate All Users via SID Brute-Force

When enumdomusers is blocked, use RID cycling: enumerate SIDs sequentially to resolve every user and group.

# In rpcclient — manual cycling
lookupsids S-1-5-21-1234567890-1234567890-1234567890-500
lookupsids S-1-5-21-1234567890-1234567890-1234567890-501
lookupsids S-1-5-21-1234567890-1234567890-1234567890-1000
lookupsids S-1-5-21-1234567890-1234567890-1234567890-1001

Automated RID cycling (bash one-liner):

# First get the domain SID
rpcclient -U "" -N 10.10.10.10 -c "lsaquery"
 
# Then cycle RIDs 500–1200
for i in $(seq 500 1200); do
  rpcclient -U "" -N 10.10.10.10 -c "lookupsids S-1-5-21-DOMAIN_SID-$i" 2>/dev/null | grep -v "NT_STATUS"
done

Replace S-1-5-21-DOMAIN_SID with the actual domain SID from lsaquery.

📌 6) Domain Information

# Get domain SID
lsaquery
 
# Domain info (name, DNS domain, forest)
dsroledominfo
 
# Query domain password policy
getdompwinfo
passpol
 
# Server info
srvinfo
 
# DC info
dsenumdomtrusts

# List shares
netshareenum
netshareenumall
 
# Get info on a specific share
netsharegetinfo <sharename>

📌 8) Printer Enumeration

# List printers
enumprinters
 
# Get printer info
getprinterdata <printer>

📌 9) Non-Interactive Single Commands

Run a single command without entering the shell:

# Get domain users non-interactively
rpcclient -U "" -N 10.10.10.10 -c "enumdomusers"
 
# Get domain SID
rpcclient -U "" -N 10.10.10.10 -c "lsaquery"
 
# Look up a username to SID
rpcclient -U "" -N 10.10.10.10 -c "lookupnames administrator"
 
# Server info
rpcclient -U admin%password 10.10.10.10 -c "srvinfo"

📌 10) All Common RPC Commands (Quick Reference)

Command	Description
`srvinfo`	Server info (OS, type)
`enumdomusers`	List domain users
`enumdomgroups`	List domain groups
`enumalsgroups domain`	List local (alias) groups
`enumalsgroups builtin`	List builtin groups
`queryuser <RID>`	Detailed info on a user by RID
`querygroup <RID>`	Group info by RID
`querygroupmem <RID>`	Members of a group by RID
`queryaliasmem builtin <RID>`	Members of a builtin group
`lookupnames <name>`	Resolve a name to SID
`lookupsids <SID>`	Resolve a SID to name
`lsaquery`	Query LSA info (domain SID)
`dsroledominfo`	Domain role info
`getdompwinfo`	Domain password policy
`passpol`	Password policy (alternative)
`netshareenum`	List shares
`netshareenumall`	List all shares including hidden
`netsharegetinfo <share>`	Info on a specific share
`enumprinters`	List printers
`dsenumdomtrusts`	Enumerate domain trusts
`enumprivs`	Current user’s privileges
`getusername`	Current session username

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# Connect null session
rpcclient -U '' -N $IP
# or: rpcclient -U "" -N TARGET
 
# Interactive — once connected:
rpcclient $> enumdomusers
rpcclient $> enumdomgroups
rpcclient $> lsaquery
rpcclient $> srvinfo
rpcclient $> getdompwinfo
 
# Non-interactive — dump all users
rpcclient -U '' -N $IP -c "enumdomusers" | tee rpc_users.txt
 
# Auto queryuser every RID — Description/Comment cred hunt
# → [[rpcclient - queryuser RID Enumeration]]
 
# RID cycling (find all users/groups)
for i in $(seq 500 1200); do
  rpcclient -U "" -N TARGET -c "lookupsids S-1-5-21-DOMAINSID-$i" 2>/dev/null | grep -v "NT_STATUS"
done

Pearson's OSCP Notebook

Explorer

rpcclient

rpcclient — RPC Enumeration Reference

What is rpcclient?

Install (Kali)

📌 OSCP workflow — null session + enumdomusers

Parse usernames for spray / Kerberos

Syntax

📌 1) Connection Flags

📌 2) Connecting

📌 3) User Enumeration

📌 4) Group Enumeration

📌 5) RID Cycling — Enumerate All Users via SID Brute-Force

📌 6) Domain Information

📌 8) Printer Enumeration

📌 9) Non-Interactive Single Commands

📌 10) All Common RPC Commands (Quick Reference)

📌 Quick OSCP Cheat Sheet (Copy/Paste)

Graph View

Table of Contents

Backlinks

Pearson's OSCP Notebook

Explorer

rpcclient

rpcclient — RPC Enumeration Reference

What is rpcclient?

Install (Kali)

📌 OSCP workflow — null session + enumdomusers

Parse usernames for spray / Kerberos

Syntax

📌 1) Connection Flags

📌 2) Connecting

📌 3) User Enumeration

📌 4) Group Enumeration

📌 5) RID Cycling — Enumerate All Users via SID Brute-Force

📌 6) Domain Information

📌 7) Share Enumeration

📌 8) Printer Enumeration

📌 9) Non-Interactive Single Commands

📌 10) All Common RPC Commands (Quick Reference)

📌 Quick OSCP Cheat Sheet (Copy/Paste)

Related Tools

Related Notes

Graph View

Table of Contents

Backlinks