pentesting-msrpc

Run rpcdump.py from impacket against the target on port 135 to list IFIDs, named pipes, and bindings. If 135 is filtered, query over SMB with rpcdump.py -port 445 using credentials, or use Metasploit's auxiliary/scanner/dcerpc/endpoint_mapper module.

Key pipes include \pipe\samr for lockout-safe user enumeration, \pipe\svcctl and \pipe\atsvc for remote command execution with credentials, \pipe\lsarpc for LSA access, and \pipe\winreg for remote registry reads. Their presence in rpcdump output confirms the corresponding abuse primitives.

Yes. The IOXIDResolver interface's ServerAlive2 method leaks all network interfaces including IPv6 addresses without authentication, and the endpoint mapper itself can be queried anonymously on many hosts. Tools like IOXIDResolver.py and rpcmap.py perform this unauthenticated discovery.

Use impacket's dcomexec.py with a domain or local account, optionally specifying objects like MMC20, ShellWindows, or ShellBrowserWindow if one is blocked. It also supports pass-the-hash via the -hashes flag, yielding a semi-interactive shell without creating a new service.

No. The SAMR interface over \pipe\samr allows user enumeration and password grinding without incrementing the bad-password counter, so account lockout policies do not interfere. Tools like samrdump.py and rpcclient's enumdomusers use this interface.

RPC fuzzing with NtObjectManager and MS-RPC-Fuzzer should only run on isolated test VMs because it is destructive and can crash services or cause BSODs. It is intended for researching RPC attack surface, never for production or client systems.