RPC Endpoints
Nmap discovered that MSRCP service is running on the target port 135
┌──(kali㉿kali)-[~/archive/htb/labs/bastard]
└─$ impacket-rpcdump $IP
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Retrieving endpoint list from 10.10.10.9
protocol: [MS-RSP]: Remote Shutdown Protocol
provider: wininit.exe
uuid : D95AFE70-A6D5-4259-822E-2C84DA1DDB0D v1.0
bindings:
ncacn_ip_tcp:10.10.10.9[49152]
ncalrpc:[WindowsShutdown]
ncacn_np:\\BASTARD[\PIPE\InitShutdown]
ncalrpc:[WMsgKRpc084E30]
protocol: N/A
provider: winlogon.exe
uuid : 76F226C3-EC14-4325-8A99-6A46348418AF v1.0
bindings:
ncalrpc:[WindowsShutdown]
ncacn_np:\\BASTARD[\PIPE\InitShutdown]
ncalrpc:[WMsgKRpc084E30]
ncalrpc:[WMsgKRpc0867A1]
protocol: N/A
provider: sysntfy.dll
uuid : C9AC6DB5-82B7-4E55-AE8A-E464ED7B4277 v1.0 Impl friendly name
bindings:
ncalrpc:[LRPC-9a311954dc9d2d866b]
ncalrpc:[senssvc]
ncalrpc:[OLE3746622F7E6F46688C3EC6172DB0]
ncalrpc:[IUserProfile2]
ncalrpc:[LRPC-afada85e659f64188c]
ncalrpc:[IUserProfile2]
ncalrpc:[LRPC-afada85e659f64188c]
ncalrpc:[LRPC-afada85e659f64188c]
protocol: N/A
provider: nrpsrv.dll
uuid : 30ADC50C-5CBC-46CE-9A0E-91914789E23C v1.0 NRP server endpoint
bindings:
ncalrpc:[dhcpcsvc]
ncalrpc:[dhcpcsvc6]
ncacn_ip_tcp:10.10.10.9[49153]
ncacn_np:\\BASTARD[\pipe\eventlog]
ncalrpc:[eventlog]
protocol: N/A
provider: dhcpcsvc.dll
uuid : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D5 v1.0 DHCP Client LRPC Endpoint
bindings:
ncalrpc:[dhcpcsvc]
ncalrpc:[dhcpcsvc6]
ncacn_ip_tcp:10.10.10.9[49153]
ncacn_np:\\BASTARD[\pipe\eventlog]
ncalrpc:[eventlog]
protocol: N/A
provider: dhcpcsvc6.dll
uuid : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D6 v1.0 DHCPv6 Client LRPC Endpoint
bindings:
ncalrpc:[dhcpcsvc6]
ncacn_ip_tcp:10.10.10.9[49153]
ncacn_np:\\BASTARD[\pipe\eventlog]
ncalrpc:[eventlog]
protocol: [MS-EVEN6]: EventLog Remoting Protocol
provider: wevtsvc.dll
uuid : F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C v1.0 Event log TCPIP
bindings:
ncacn_ip_tcp:10.10.10.9[49153]
ncacn_np:\\BASTARD[\pipe\eventlog]
ncalrpc:[eventlog]
protocol: N/A
provider: srvsvc.dll
uuid : 98716D03-89AC-44C7-BB8C-285824E51C4A v1.0 XactSrv service
bindings:
ncacn_ip_tcp:10.10.10.9[49154]
ncacn_np:\\BASTARD[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE3746622F7E6F46688C3EC6172DB0]
ncalrpc:[IUserProfile2]
ncalrpc:[LRPC-afada85e659f64188c]
protocol: N/A
provider: iphlpsvc.dll
uuid : 552D076A-CB29-4E44-8B6A-D15E59E2C0AF v1.0 IP Transition Configuration endpoint
bindings:
ncacn_ip_tcp:10.10.10.9[49154]
ncacn_np:\\BASTARD[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE3746622F7E6F46688C3EC6172DB0]
ncalrpc:[IUserProfile2]
ncalrpc:[LRPC-afada85e659f64188c]
protocol: N/A
provider: IKEEXT.DLL
uuid : A398E520-D59A-4BDD-AA7A-3C1E0303A511 v1.0 IKE/Authip API
bindings:
ncacn_ip_tcp:10.10.10.9[49154]
ncacn_np:\\BASTARD[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE3746622F7E6F46688C3EC6172DB0]
ncalrpc:[IUserProfile2]
ncalrpc:[LRPC-afada85e659f64188c]
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: schedsvc.dll
uuid : 86D35949-83C9-4044-B424-DB363231FD0C v1.0
bindings:
ncacn_ip_tcp:10.10.10.9[49154]
ncacn_np:\\BASTARD[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE3746622F7E6F46688C3EC6172DB0]
ncalrpc:[IUserProfile2]
ncalrpc:[LRPC-afada85e659f64188c]
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: taskcomp.dll
uuid : 378E52B0-C0A9-11CF-822D-00AA0051E40F v1.0
bindings:
ncacn_np:\\BASTARD[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE3746622F7E6F46688C3EC6172DB0]
ncalrpc:[IUserProfile2]
ncalrpc:[LRPC-afada85e659f64188c]
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: taskcomp.dll
uuid : 1FF70682-0A51-30E8-076D-740BE8CEE98B v1.0
bindings:
ncacn_np:\\BASTARD[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE3746622F7E6F46688C3EC6172DB0]
ncalrpc:[IUserProfile2]
ncalrpc:[LRPC-afada85e659f64188c]
protocol: N/A
provider: schedsvc.dll
uuid : 0A74EF1C-41A4-4E06-83AE-DC74FB1CDD53 v1.0
bindings:
ncalrpc:[senssvc]
ncalrpc:[OLE3746622F7E6F46688C3EC6172DB0]
ncalrpc:[IUserProfile2]
ncalrpc:[LRPC-afada85e659f64188c]
protocol: N/A
provider: gpsvc.dll
uuid : 2EB08E3E-639F-4FBA-97B1-14F878961076 v1.0
bindings:
ncalrpc:[IUserProfile2]
ncalrpc:[LRPC-afada85e659f64188c]
protocol: N/A
provider: N/A
uuid : 3473DD4D-2E88-4006-9CBA-22570909DD10 v5.1 WinHttp Auto-Proxy Service
bindings:
ncalrpc:[LRPC-5d3e921c0ec5d28988]
ncalrpc:[OLECDC9FD7D105C42B98EA6E67A5222]
protocol: N/A
provider: nsisvc.dll
uuid : 7EA70BCF-48AF-4F6A-8968-6A440754D5FA v1.0 NSI server endpoint
bindings:
ncalrpc:[LRPC-5d3e921c0ec5d28988]
ncalrpc:[OLECDC9FD7D105C42B98EA6E67A5222]
protocol: N/A
provider: authui.dll
uuid : 24019106-A203-4642-B88D-82DAE9158929 v1.0
bindings:
ncalrpc:[LRPC-9126d9e81f7c98e538]
protocol: N/A
provider: MPSSVC.dll
uuid : 2FB92682-6599-42DC-AE13-BD2CA89BD11C v1.0 Fw APIs
bindings:
ncalrpc:[LRPC-c156576917563e7ec0]
protocol: N/A
provider: MPSSVC.dll
uuid : 7F9D11BF-7FB9-436B-A812-B2D50C5D4C03 v1.0 Fw APIs
bindings:
ncalrpc:[LRPC-c156576917563e7ec0]
protocol: N/A
provider: BFE.DLL
uuid : DD490425-5325-4565-B774-7E27D6C09C24 v1.0 Base Firewall Engine API
bindings:
ncalrpc:[LRPC-c156576917563e7ec0]
protocol: N/A
provider: spoolsv.exe
uuid : 4A452661-8290-4B36-8FBE-7F4093A94978 v1.0 Spooler function endpoint
bindings:
ncalrpc:[spoolss]
protocol: [MS-PAN]: Print System Asynchronous Notification Protocol
provider: spoolsv.exe
uuid : AE33069B-A2A8-46EE-A235-DDFD339BE281 v1.0 Spooler base remote object endpoint
bindings:
ncalrpc:[spoolss]
protocol: [MS-PAN]: Print System Asynchronous Notification Protocol
provider: spoolsv.exe
uuid : 0B6EDBFA-4A24-4FC6-8A23-942B1ECA65D1 v1.0 Spooler function endpoint
bindings:
ncalrpc:[spoolss]
protocol: [MS-SCMR]: Service Control Manager Remote Protocol
provider: services.exe
uuid : 367ABB81-9844-35F1-AD32-98F038001003 v2.0
bindings:
ncacn_ip_tcp:10.10.10.9[49155]
protocol: [MS-CMPO]: MSDTC Connection Manager:
provider: msdtcprx.dll
uuid : 906B0CE0-C70B-1067-B317-00DD010662DA v1.0
bindings:
ncalrpc:[LRPC-be580e4c40c0c4e186]
ncalrpc:[OLE3033E7B876874B3D84E3F4E24E78]
ncalrpc:[LRPC-b756691d7d22a1843f]
ncalrpc:[LRPC-b756691d7d22a1843f]
ncalrpc:[LRPC-b756691d7d22a1843f]
ncalrpc:[LRPC-b756691d7d22a1843f]
protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol
provider: samsrv.dll
uuid : 12345778-1234-ABCD-EF00-0123456789AC v1.0
bindings:
ncacn_ip_tcp:10.10.10.9[49156]
ncalrpc:[samss lpc]
ncalrpc:[dsrole]
ncacn_np:\\BASTARD[\PIPE\protected_storage]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncalrpc:[LRPC-a298d682b57466127e]
ncacn_np:\\BASTARD[\pipe\lsass]
[*] Received 103 endpoints.There are a total of 103 RPC end points.
based on the printed output, i learned the following:
- The target host is
BASTARD - Windows Spooler service,
spoolsv.exe, is running
IOXIDResolver.py
┌──(kali㉿kali)-[~/archive/htb/labs/bastard]
└─$ python3 IOXIDResolver.py -t $IP
[*] Retrieving network interface of 10.10.10.9
Address: Bastard
Address: 10.10.10.9
There is no other NICs in the target host