InfoSec LAB

Blue_MSRPC

Created: 5 min read

MSRPC

Nmap discovered a MSRPC service on the target port 135

┌──(kali㉿kali)-[~/archive/htb/labs/blue]
└─$ rpcclient $IP -N -U ''
rpcclient $> lsaenumsid
do_cmd: Could not initialise lsarpc. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> enumprinters
do_cmd: Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomgroups
do_cmd: Could not initialise samr. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomusers
do_cmd: Could not initialise samr. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> lsaquery
do_cmd: Could not initialise lsarpc. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> netshareenumall
do_cmd: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED

While the MSRPC service allows anonymous access, lack of privileges prevents further enumeration

RPC Endpoints

┌──(kali㉿kali)-[~/archive/htb/labs/blue]
└─$ impacket-rpcdump $IP
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
 
[*] Retrieving endpoint list from 10.10.10.40
Protocol: [MS-RSP]: Remote Shutdown Protocol 
Provider: wininit.exe 
UUID    : D95AFE70-A6D5-4259-822E-2C84DA1DDB0D v1.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.40[49152]
          ncalrpc:[WindowsShutdown]
          ncacn_np:\\HARIS-PC[\PIPE\InitShutdown]
          ncalrpc:[WMsgKRpc08A480]
 
Protocol: N/A 
Provider: winlogon.exe 
UUID    : 76F226C3-EC14-4325-8A99-6A46348418AF v1.0 
Bindings: 
          ncalrpc:[WindowsShutdown]
          ncacn_np:\\HARIS-PC[\PIPE\InitShutdown]
          ncalrpc:[WMsgKRpc08A480]
          ncalrpc:[WMsgKRpc08D6B1]
 
Protocol: N/A 
Provider: sysntfy.dll 
UUID    : C9AC6DB5-82B7-4E55-AE8A-E464ED7B4277 v1.0 Impl friendly name
Bindings: 
          ncalrpc:[LRPC-d65252a200f4caffed]
          ncalrpc:[senssvc]
          ncalrpc:[OLEE561BF509D3D4BB1B73715A5DC48]
          ncalrpc:[IUserProfile2]
          ncalrpc:[LRPC-73be30e4ef1fe48211]
          ncalrpc:[IUserProfile2]
          ncalrpc:[LRPC-73be30e4ef1fe48211]
          ncalrpc:[LRPC-73be30e4ef1fe48211]
 
Protocol: N/A 
Provider: wscsvc.dll 
UUID    : 06BBA54A-BE05-49F9-B0A0-30F790261023 v1.0 Security Center
Bindings: 
          ncalrpc:[OLE7616861D4882400CAB0529FFAE79]
          ncalrpc:[dhcpcsvc6]
          ncalrpc:[dhcpcsvc]
          ncalrpc:[Audiosrv]
          ncalrpc:[AudioClientRpc]
          ncacn_ip_tcp:10.10.10.40[49153]
          ncacn_np:\\HARIS-PC[\pipe\eventlog]
          ncalrpc:[eventlog]
 
Protocol: N/A 
Provider: nrpsrv.dll 
UUID    : 30ADC50C-5CBC-46CE-9A0E-91914789E23C v1.0 NRP server endpoint
Bindings: 
          ncalrpc:[dhcpcsvc6]
          ncalrpc:[dhcpcsvc]
          ncalrpc:[Audiosrv]
          ncalrpc:[AudioClientRpc]
          ncacn_ip_tcp:10.10.10.40[49153]
          ncacn_np:\\HARIS-PC[\pipe\eventlog]
          ncalrpc:[eventlog]
 
Protocol: N/A 
Provider: dhcpcsvc6.dll 
UUID    : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D6 v1.0 DHCPv6 Client LRPC Endpoint
Bindings: 
          ncalrpc:[dhcpcsvc6]
          ncalrpc:[dhcpcsvc]
          ncalrpc:[Audiosrv]
          ncalrpc:[AudioClientRpc]
          ncacn_ip_tcp:10.10.10.40[49153]
          ncacn_np:\\HARIS-PC[\pipe\eventlog]
          ncalrpc:[eventlog]
 
Protocol: N/A 
Provider: dhcpcsvc.dll 
UUID    : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D5 v1.0 DHCP Client LRPC Endpoint
Bindings: 
          ncalrpc:[dhcpcsvc]
          ncalrpc:[Audiosrv]
          ncalrpc:[AudioClientRpc]
          ncacn_ip_tcp:10.10.10.40[49153]
          ncacn_np:\\HARIS-PC[\pipe\eventlog]
          ncalrpc:[eventlog]
 
Protocol: [MS-EVEN6]: EventLog Remoting Protocol 
Provider: wevtsvc.dll 
UUID    : F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C v1.0 Event log TCPIP
Bindings: 
          ncacn_ip_tcp:10.10.10.40[49153]
          ncacn_np:\\HARIS-PC[\pipe\eventlog]
          ncalrpc:[eventlog]
 
Protocol: N/A 
Provider: srvsvc.dll 
UUID    : 98716D03-89AC-44C7-BB8C-285824E51C4A v1.0 XactSrv service
Bindings: 
          ncacn_ip_tcp:10.10.10.40[49154]
          ncacn_np:\\HARIS-PC[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLEE561BF509D3D4BB1B73715A5DC48]
          ncalrpc:[IUserProfile2]
          ncalrpc:[LRPC-73be30e4ef1fe48211]
 
Protocol: N/A 
Provider: iphlpsvc.dll 
UUID    : 552D076A-CB29-4E44-8B6A-D15E59E2C0AF v1.0 IP Transition Configuration endpoint
Bindings: 
          ncacn_ip_tcp:10.10.10.40[49154]
          ncacn_np:\\HARIS-PC[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLEE561BF509D3D4BB1B73715A5DC48]
          ncalrpc:[IUserProfile2]
          ncalrpc:[LRPC-73be30e4ef1fe48211]
 
Protocol: N/A 
Provider: IKEEXT.DLL 
UUID    : A398E520-D59A-4BDD-AA7A-3C1E0303A511 v1.0 IKE/Authip API
Bindings: 
          ncacn_ip_tcp:10.10.10.40[49154]
          ncacn_np:\\HARIS-PC[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLEE561BF509D3D4BB1B73715A5DC48]
          ncalrpc:[IUserProfile2]
          ncalrpc:[LRPC-73be30e4ef1fe48211]
 
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol 
Provider: schedsvc.dll 
UUID    : 86D35949-83C9-4044-B424-DB363231FD0C v1.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.40[49154]
          ncacn_np:\\HARIS-PC[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLEE561BF509D3D4BB1B73715A5DC48]
          ncalrpc:[IUserProfile2]
          ncalrpc:[LRPC-73be30e4ef1fe48211]
 
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol 
Provider: taskcomp.dll 
UUID    : 378E52B0-C0A9-11CF-822D-00AA0051E40F v1.0 
Bindings: 
          ncacn_np:\\HARIS-PC[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLEE561BF509D3D4BB1B73715A5DC48]
          ncalrpc:[IUserProfile2]
          ncalrpc:[LRPC-73be30e4ef1fe48211]
 
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol 
Provider: taskcomp.dll 
UUID    : 1FF70682-0A51-30E8-076D-740BE8CEE98B v1.0 
Bindings: 
          ncacn_np:\\HARIS-PC[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLEE561BF509D3D4BB1B73715A5DC48]
          ncalrpc:[IUserProfile2]
          ncalrpc:[LRPC-73be30e4ef1fe48211]
 
Protocol: N/A 
Provider: schedsvc.dll 
UUID    : 0A74EF1C-41A4-4E06-83AE-DC74FB1CDD53 v1.0 
Bindings: 
          ncalrpc:[senssvc]
          ncalrpc:[OLEE561BF509D3D4BB1B73715A5DC48]
          ncalrpc:[IUserProfile2]
          ncalrpc:[LRPC-73be30e4ef1fe48211]
 
Protocol: N/A 
Provider: gpsvc.dll 
UUID    : 2EB08E3E-639F-4FBA-97B1-14F878961076 v1.0 
Bindings: 
          ncalrpc:[IUserProfile2]
          ncalrpc:[LRPC-73be30e4ef1fe48211]
 
Protocol: N/A 
Provider: authui.dll 
UUID    : 24019106-A203-4642-B88D-82DAE9158929 v1.0 
Bindings: 
          ncalrpc:[LRPC-3364b1a0d2b869ebbe]
 
Protocol: N/A 
Provider: N/A 
UUID    : 3473DD4D-2E88-4006-9CBA-22570909DD10 v5.1 WinHttp Auto-Proxy Service
Bindings: 
          ncacn_np:\\HARIS-PC[\PIPE\W32TIME_ALT]
          ncalrpc:[W32TIME_ALT]
          ncalrpc:[LRPC-0587e109240c85c3d6]
          ncalrpc:[OLEB4C37B7F721D41B4AC5A24FE3B0E]
 
Protocol: N/A 
Provider: nsisvc.dll 
UUID    : 7EA70BCF-48AF-4F6A-8968-6A440754D5FA v1.0 NSI server endpoint
Bindings: 
          ncalrpc:[LRPC-0587e109240c85c3d6]
          ncalrpc:[OLEB4C37B7F721D41B4AC5A24FE3B0E]
 
Protocol: N/A 
Provider: spoolsv.exe 
UUID    : 4A452661-8290-4B36-8FBE-7F4093A94978 v1.0 Spooler function endpoint
Bindings: 
          ncalrpc:[spoolss]
 
Protocol: [MS-PAN]: Print System Asynchronous Notification Protocol 
Provider: spoolsv.exe 
UUID    : AE33069B-A2A8-46EE-A235-DDFD339BE281 v1.0 Spooler base remote object endpoint
Bindings: 
          ncalrpc:[spoolss]
 
Protocol: [MS-PAN]: Print System Asynchronous Notification Protocol 
Provider: spoolsv.exe 
UUID    : 0B6EDBFA-4A24-4FC6-8A23-942B1ECA65D1 v1.0 Spooler function endpoint
Bindings: 
          ncalrpc:[spoolss]
 
Protocol: N/A 
Provider: MPSSVC.dll 
UUID    : 2FB92682-6599-42DC-AE13-BD2CA89BD11C v1.0 Fw APIs
Bindings: 
          ncalrpc:[LRPC-2cd17a26dcff5719ea]
 
Protocol: N/A 
Provider: MPSSVC.dll 
UUID    : 7F9D11BF-7FB9-436B-A812-B2D50C5D4C03 v1.0 Fw APIs
Bindings: 
          ncalrpc:[LRPC-2cd17a26dcff5719ea]
 
Protocol: N/A 
Provider: BFE.DLL 
UUID    : DD490425-5325-4565-B774-7E27D6C09C24 v1.0 Base Firewall Engine API
Bindings: 
          ncalrpc:[LRPC-2cd17a26dcff5719ea]
 
Protocol: N/A 
Provider: sysmain.dll 
UUID    : B58AA02E-2884-4E97-8176-4EE06D794184 v1.0 
Bindings: 
          ncalrpc:[trkwks]
          ncacn_np:\\HARIS-PC[\pipe\trkwks]
          ncalrpc:[LRPC-adddc2555afbc8bcbc]
          ncalrpc:[OLEC81049E8EAAE4C209D374AA0CAC4]
 
Protocol: N/A 
Provider: pcasvc.dll 
UUID    : 0767A036-0D22-48AA-BA69-B619480F38CB v1.0 PcaSvc
Bindings: 
          ncalrpc:[LRPC-adddc2555afbc8bcbc]
          ncalrpc:[OLEC81049E8EAAE4C209D374AA0CAC4]
 
Protocol: [MS-SCMR]: Service Control Manager Remote Protocol 
Provider: services.exe 
UUID    : 367ABB81-9844-35F1-AD32-98F038001003 v2.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.40[49155]
 
Protocol: [MS-RPRN]: Print System Remote Protocol 
Provider: spoolsv.exe 
UUID    : 12345678-1234-ABCD-EF00-0123456789AB v1.0 IPSec Policy agent endpoint
Bindings: 
          ncalrpc:[LRPC-5be7ded77e6818581c]
          ncacn_ip_tcp:10.10.10.40[49156]
 
Protocol: [MS-FASP]: Firewall and Advanced Security Protocol 
Provider: FwRemoteSvr.dll 
UUID    : 6B5BDD1E-528C-422C-AF8C-A4079BE4FE48 v1.0 Remote Fw APIs
Bindings: 
          ncacn_ip_tcp:10.10.10.40[49156]
 
Protocol: [MS-CMPO]: MSDTC Connection Manager: 
Provider: msdtcprx.dll 
UUID    : 906B0CE0-C70B-1067-B317-00DD010662DA v1.0 
Bindings: 
          ncalrpc:[LRPC-0812308d4890739a33]
          ncalrpc:[LRPC-0812308d4890739a33]
          ncalrpc:[LRPC-0812308d4890739a33]
          ncalrpc:[LRPC-0812308d4890739a33]
 
Protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol 
Provider: samsrv.dll 
UUID    : 12345778-1234-ABCD-EF00-0123456789AC v1.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.40[49157]
          ncalrpc:[samss lpc]
          ncacn_np:\\HARIS-PC[\PIPE\protected_storage]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncalrpc:[LRPC-3fccf7d6793f42364c]
          ncacn_np:\\HARIS-PC[\pipe\lsass]
 
[*] Received 125 endpoints.

impacket-rpcdump discovered a total of 125 RPC endpoints Spooler service is running

IOXIDResolver

┌──(kali㉿kali)-[~/archive/htb/labs/blue]
└─$ python3 IOXIDResolver.py -t $IP
[*] Retrieving network interface of 10.10.10.40
address: haris-PC
address: 10.10.10.40
address: dead:beef::5061:455f:610f:174d
address: dead:beef::8902:6a2b:3128:3f78

IOXIDResolver.py identified the hostname of the target system It also found 2 IPv6 addresses

IPv6

┌──(kali㉿kali)-[~/archive/htb/labs/blue]
└─$ rustscan -a dead:beef::5061:455f:610f:174d -b 20000
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
🌍HACK THE PLANET🌍
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
Open [dead:beef::5061:455f:610f:174d]:135
Open [dead:beef::5061:455f:610f:174d]:445
 
┌──(kali㉿kali)-[~/archive/htb/labs/blue]
└─$ rustscan -a dead:beef::8902:6a2b:3128:3f78 -b 20000
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
Open [dead:beef::8902:6a2b:3128:3f78]:135
Open [dead:beef::8902:6a2b:3128:3f78]:445

It doesn’t appear that those 2 IPv6 addresses provide any additional service compared to the IPv4 counterpart

Interactive Graph View

Backlinks