Pearson's OSCP Notebook

rpcclient - queryuser RID Enumeration

Properties1
tagsrpcclient, enumdomusers, queryuser, rid, enumeration, active-directory, description, credentials, oscp

4 min read

rpcclient — enumdomusers → queryuser (RID automation)

Ctrl+F: enumdomusers · queryuser · RID · Description · Comment · queryusers.sh · HotelCalifornia

External: Internal All The Things — Enumeration

During AD assessment, enumdomusers returns every user RID. Feed those RIDs into queryuser to dump Description, Comment, and other fields — labs often hide passwords or hints there (e.g. HotelCalifornia194! in a new-hire description).

→ rpcclient (full command reference) · Credential Discovery · AD

Why automate this?

ManualAutomated
Copy each RID by handLoop every RID from enumdomusers
Scroll past logon hours / timestampsgrep only useful fields
Miss one userFull domain pass in one run

Real OSCP/HTB example — queryuser on a RID might show:

User Name   : V.Ventz
Description : New-hired, reminder: HotelCalifornia194!

That description is a valid password for spray / login.

📌 One-liner

Replace <TARGET> with IP or hostname.

rpcclient -U "" -N <TARGET> -c "enumdomusers" \
| awk -F'[][]' '/rid:/{print $4}' \
| while read rid; do
    echo "========== RID $rid =========="
    rpcclient -U "" -N <TARGET> -c "queryuser $rid"
    echo
done

Example:

rpcclient -U "" -N 192.168.234.187 -c "enumdomusers" \
| awk -F'[][]' '/rid:/{print $4}' \
| while read rid; do
    echo "========== RID $rid =========="
    rpcclient -U "" -N 192.168.234.187 -c "queryuser $rid"
    echo
done

📌 Script — queryusers.sh

Save on Kali:

#!/bin/bash
 
TARGET="$1"
 
if [ -z "$TARGET" ]; then
    echo "Usage: $0 <target>"
    exit 1
fi
 
rpcclient -U "" -N "$TARGET" -c "enumdomusers" \
| awk -F'[][]' '/rid:/{print $4}' \
| while read rid; do
    echo "[*] Querying RID $rid"
    rpcclient -U "" -N "$TARGET" -c "queryuser $rid"
    echo "--------------------------------------"
done

Run:

chmod +x queryusers.sh
./queryusers.sh 192.168.234.187

With creds (not null session) — change -U "" -N to -U 'user%pass' in both rpcclient lines.

📌 Filtered — interesting fields only (recommended)

Skip password timestamps and logon hours; highlight cred leaks:

TARGET=192.168.234.187
 
rpcclient -U "" -N "$TARGET" -c "enumdomusers" \
| awk -F'[][]' '/rid:/{print $4}' \
| while read rid; do
    echo "===== $rid ====="
    rpcclient -U "" -N "$TARGET" -c "queryuser $rid" \
        | egrep "User Name|Description|Password|Comment|Profile Path|Logon Script"
done

As script queryusers-grep.sh:

#!/bin/bash
TARGET="$1"
[ -z "$TARGET" ] && { echo "Usage: $0 <target>"; exit 1; }
 
rpcclient -U "" -N "$TARGET" -c "enumdomusers" \
| awk -F'[][]' '/rid:/{print $4}' \
| while read rid; do
    echo "===== $rid ====="
    rpcclient -U "" -N "$TARGET" -c "queryuser $rid" \
        | egrep -i "User Name|Description|Password|Comment|Profile Path|Logon Script"
done
chmod +x queryusers-grep.sh
./queryusers-grep.sh 192.168.234.187 | tee rpc_queryuser_hits.txt

→ grep · Password Attacks

📌 Full AD rpcclient enum sequence

Automate these in order — often reveals creds or attack paths beyond user descriptions:

TARGET=192.168.234.187
RPC='rpcclient -U "" -N '"$TARGET"' -c'
 
$RPC "enumdomusers" | tee rpc_users.txt
# then run queryuser loop (above)
 
$RPC "enumdomgroups"
$RPC "querygroup 0x200"          # Domain Admins — adjust RID as needed
$RPC "enumprinters"
$RPC "enumdrivers"               # if supported on target
$RPC "netshareenum"
$RPC "srvinfo"
$RPC "lsaquery"
# lookupsids — after you have domain SID from lsaquery

Interactive equivalent at rpcclient $> prompt:

enumdomusers
queryuser <RID>
enumdomgroups
querygroup <RID>
enumprinters
enumdrivers
netshareenum
srvinfo
lsaquery
lookupsids

→ rpcclient > 📌 10) All Common RPC Commands (Quick Reference)

📌 After you find a password in Description

Description field → password candidate
  → spray / manual login (RDP, WinRM, SMB)
  → [[Kerbrute]] passwordspray
  → [[CrackMapExec - nxc]] smb/winrm
  → [[evil-winrm]] / [[xfreerdp]]

→ Credential Graph

📌 Quick cheat sheet

# Dump all users + full queryuser per RID
./queryusers.sh 192.168.234.187
 
# Description/Comment hunt only
./queryusers-grep.sh 192.168.234.187
 
# One-liner grep version
rpcclient -U "" -N $IP -c "enumdomusers" | awk -F'[][]' '/rid:/{print $4}' | while read rid; do
  echo "===== $rid ====="
  rpcclient -U "" -N $IP -c "queryuser $rid" | egrep "User Name|Description|Comment"
done

Graph View

Backlinks