InfoSec LAB

Fuse_MSRPC

Created: 7 min read

MSRPC

Nmap discovered a MSPRC service running on the target port 135 and 593

Null Session

┌──(kali㉿kali)-[~/archive/htb/labs/fuse]
└─$ rpcclient FABRICORP.LOCAL -N -U ''
rpcclient $> enumdomusers 
result was NT_STATUS_ACCESS_DENIED

The MSRPC server allows null session, but accessing resource is not available due to lack of privileges

RPC Endpoint

┌──(kali㉿kali)-[~/archive/htb/labs/fuse]
└─$ impacket-rpcdump $IP  
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
 
[*] Retrieving endpoint list from 10.10.10.193
protocol: [MS-RSP]: Remote Shutdown Protocol 
provider: wininit.exe 
uuid    : D95AFE70-A6D5-4259-822E-2C84DA1DDB0D v1.0 
bindings: 
          ncacn_ip_tcp:10.10.10.193[49664]
          ncalrpc:[WindowsShutdown]
          ncacn_np:\\FUSE[\PIPE\InitShutdown]
          ncalrpc:[WMsgKRpc07A620]
 
protocol: N/A 
provider: winlogon.exe 
uuid    : 76F226C3-EC14-4325-8A99-6A46348418AF v1.0 
bindings: 
          ncalrpc:[WindowsShutdown]
          ncacn_np:\\FUSE[\PIPE\InitShutdown]
          ncalrpc:[WMsgKRpc07A620]
          ncalrpc:[WMsgKRpc07D4C1]
 
protocol: N/A 
provider: N/A 
uuid    : D09BDEB5-6171-4A34-BFE2-06FA82652568 v1.0 
bindings: 
          ncalrpc:[csebpub]
          ncalrpc:[LRPC-ab2fc8c542e3b1aa6e]
          ncalrpc:[LRPC-28705f583deb0b25b1]
          ncacn_np:\\FUSE[\pipe\LSM_API_service]
          ncalrpc:[LSMApi]
          ncalrpc:[LRPC-eac8e03d9444bcf200]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
          ncalrpc:[LRPC-28705f583deb0b25b1]
          ncacn_np:\\FUSE[\pipe\LSM_API_service]
          ncalrpc:[LSMApi]
          ncalrpc:[LRPC-eac8e03d9444bcf200]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
          ncalrpc:[LRPC-4dd43165cfeca4d70d]
          ncalrpc:[dhcpcsvc]
          ncalrpc:[dhcpcsvc6]
          ncacn_ip_tcp:10.10.10.193[49665]
          ncacn_np:\\FUSE[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[LRPC-037c32f7ed2f1a6096]
 
protocol: N/A 
provider: N/A 
uuid    : 697DCDA9-3BA9-4EB2-9247-E11F1901B0D2 v1.0 
bindings: 
          ncalrpc:[LRPC-ab2fc8c542e3b1aa6e]
          ncalrpc:[LRPC-28705f583deb0b25b1]
          ncacn_np:\\FUSE[\pipe\LSM_API_service]
          ncalrpc:[LSMApi]
          ncalrpc:[LRPC-eac8e03d9444bcf200]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: sysntfy.dll 
uuid    : C9AC6DB5-82B7-4E55-AE8A-E464ED7B4277 v1.0 Impl friendly name
bindings: 
          ncalrpc:[LRPC-eac8e03d9444bcf200]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
          ncalrpc:[senssvc]
          ncalrpc:[OLE46F1C36C00F4CABD81F7B78A374B]
          ncalrpc:[IUserProfile2]
          ncalrpc:[IUserProfile2]
          ncalrpc:[IUserProfile2]
          ncalrpc:[OLE3D22714097A9CE240B574BD149AD]
          ncacn_ip_tcp:10.10.10.193[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\FUSE[\pipe\lsass]
 
protocol: N/A 
provider: N/A 
uuid    : 3473DD4D-2E88-4006-9CBA-22570909DD10 v5.1 WinHttp Auto-Proxy Service
bindings: 
          ncalrpc:[OLECB5823EE051BEB35C816B0174481]
          ncalrpc:[LRPC-671ab2c4ce105bcab9]
 
protocol: N/A 
provider: nsisvc.dll 
uuid    : 7EA70BCF-48AF-4F6A-8968-6A440754D5FA v1.0 NSI server endpoint
bindings: 
          ncalrpc:[LRPC-671ab2c4ce105bcab9]
 
protocol: N/A 
provider: N/A 
uuid    : A500D4C6-0DD1-4543-BC0C-D5F93486EAF8 v1.0 
bindings: 
          ncalrpc:[LRPC-388d3d0d2da8071b02]
          ncalrpc:[LRPC-4dd43165cfeca4d70d]
          ncalrpc:[dhcpcsvc]
          ncalrpc:[dhcpcsvc6]
          ncacn_ip_tcp:10.10.10.193[49665]
          ncacn_np:\\FUSE[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[LRPC-037c32f7ed2f1a6096]
 
protocol: N/A 
provider: dhcpcsvc.dll 
uuid    : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D5 v1.0 DHCP Client LRPC Endpoint
bindings: 
          ncalrpc:[dhcpcsvc]
          ncalrpc:[dhcpcsvc6]
          ncacn_ip_tcp:10.10.10.193[49665]
          ncacn_np:\\FUSE[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[LRPC-037c32f7ed2f1a6096]
 
protocol: N/A 
provider: dhcpcsvc6.dll 
uuid    : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D6 v1.0 DHCPv6 Client LRPC Endpoint
bindings: 
          ncalrpc:[dhcpcsvc6]
          ncacn_ip_tcp:10.10.10.193[49665]
          ncacn_np:\\FUSE[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[LRPC-037c32f7ed2f1a6096]
 
protocol: [MS-EVEN6]: EventLog Remoting Protocol 
provider: wevtsvc.dll 
uuid    : F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C v1.0 Event log TCPIP
bindings: 
          ncacn_ip_tcp:10.10.10.193[49665]
          ncacn_np:\\FUSE[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[LRPC-037c32f7ed2f1a6096]
 
protocol: N/A 
provider: nrpsrv.dll 
uuid    : 30ADC50C-5CBC-46CE-9A0E-91914789E23C v1.0 NRP server endpoint
bindings: 
          ncalrpc:[LRPC-037c32f7ed2f1a6096]
 
protocol: N/A 
provider: N/A 
uuid    : C49A5A70-8A7F-4E70-BA16-1E8F1F193EF1 v1.0 Adh APIs
bindings: 
          ncalrpc:[LRPC-ade11b3bf8151917f1]
          ncacn_ip_tcp:10.10.10.193[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\FUSE[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE46F1C36C00F4CABD81F7B78A374B]
          ncalrpc:[IUserProfile2]
 
protocol: N/A 
provider: N/A 
uuid    : C36BE077-E14B-4FE9-8ABC-E856EF4F048B v1.0 Proxy Manager client server endpoint
bindings: 
          ncalrpc:[LRPC-ade11b3bf8151917f1]
          ncacn_ip_tcp:10.10.10.193[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\FUSE[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE46F1C36C00F4CABD81F7B78A374B]
          ncalrpc:[IUserProfile2]
 
protocol: N/A 
provider: N/A 
uuid    : 2E6035B2-E8F1-41A7-A044-656B439C4C34 v1.0 Proxy Manager provider server endpoint
bindings: 
          ncalrpc:[LRPC-ade11b3bf8151917f1]
          ncacn_ip_tcp:10.10.10.193[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\FUSE[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE46F1C36C00F4CABD81F7B78A374B]
          ncalrpc:[IUserProfile2]
 
protocol: N/A 
provider: N/A 
uuid    : 0D3C7F20-1C8D-4654-A1B3-51563B298BDA v1.0 UserMgrCli
bindings: 
          ncalrpc:[LRPC-ade11b3bf8151917f1]
          ncacn_ip_tcp:10.10.10.193[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\FUSE[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE46F1C36C00F4CABD81F7B78A374B]
          ncalrpc:[IUserProfile2]
 
protocol: N/A 
provider: N/A 
uuid    : B18FBAB6-56F8-4702-84E0-41053293A869 v1.0 UserMgrCli
bindings: 
          ncalrpc:[LRPC-ade11b3bf8151917f1]
          ncacn_ip_tcp:10.10.10.193[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\FUSE[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE46F1C36C00F4CABD81F7B78A374B]
          ncalrpc:[IUserProfile2]
 
protocol: N/A 
provider: iphlpsvc.dll 
uuid    : 552D076A-CB29-4E44-8B6A-D15E59E2C0AF v1.0 IP Transition Configuration endpoint
bindings: 
          ncacn_ip_tcp:10.10.10.193[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\FUSE[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE46F1C36C00F4CABD81F7B78A374B]
          ncalrpc:[IUserProfile2]
 
protocol: N/A 
provider: N/A 
uuid    : 3A9EF155-691D-4449-8D05-09AD57031823 v1.0 
bindings: 
          ncacn_ip_tcp:10.10.10.193[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\FUSE[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE46F1C36C00F4CABD81F7B78A374B]
          ncalrpc:[IUserProfile2]
 
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol 
provider: schedsvc.dll 
uuid    : 86D35949-83C9-4044-B424-DB363231FD0C v1.0 
bindings: 
          ncacn_ip_tcp:10.10.10.193[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\FUSE[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE46F1C36C00F4CABD81F7B78A374B]
          ncalrpc:[IUserProfile2]
 
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol 
provider: taskcomp.dll 
uuid    : 378E52B0-C0A9-11CF-822D-00AA0051E40F v1.0 
bindings: 
          ncacn_np:\\FUSE[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE46F1C36C00F4CABD81F7B78A374B]
          ncalrpc:[IUserProfile2]
 
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol 
provider: taskcomp.dll 
uuid    : 1FF70682-0A51-30E8-076D-740BE8CEE98B v1.0 
bindings: 
          ncacn_np:\\FUSE[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE46F1C36C00F4CABD81F7B78A374B]
          ncalrpc:[IUserProfile2]
 
protocol: N/A 
provider: schedsvc.dll 
uuid    : 0A74EF1C-41A4-4E06-83AE-DC74FB1CDD53 v1.0 
bindings: 
          ncalrpc:[senssvc]
          ncalrpc:[OLE46F1C36C00F4CABD81F7B78A374B]
          ncalrpc:[IUserProfile2]
 
protocol: N/A 
provider: gpsvc.dll 
uuid    : 2EB08E3E-639F-4FBA-97B1-14F878961076 v1.0 Group Policy RPC Interface
bindings: 
          ncalrpc:[LRPC-f9289893c0534aad6a]
 
protocol: N/A 
provider: N/A 
uuid    : 7F1343FE-50A9-4927-A778-0C5859517BAC v1.0 DfsDs service
bindings: 
          ncacn_np:\\FUSE[\PIPE\wkssvc]
          ncalrpc:[LRPC-c4efe55d99e01acdc2]
          ncalrpc:[DNSResolver]
 
protocol: N/A 
provider: N/A 
uuid    : EB081A0D-10EE-478A-A1DD-50995283E7A8 v3.0 Witness Client Test Interface
bindings: 
          ncalrpc:[LRPC-c4efe55d99e01acdc2]
          ncalrpc:[DNSResolver]
 
protocol: N/A 
provider: N/A 
uuid    : F2C9B409-C1C9-4100-8639-D8AB1486694A v1.0 Witness Client Upcall Server
bindings: 
          ncalrpc:[LRPC-c4efe55d99e01acdc2]
          ncalrpc:[DNSResolver]
 
protocol: N/A 
provider: N/A 
uuid    : DF4DF73A-C52D-4E3A-8003-8437FDF8302A v0.0 WM_WindowManagerRPC\Server
bindings: 
          ncalrpc:[LRPC-2bb4a07a1b88ffb517]
          ncalrpc:[OLE4AE9D57C191B4F87070C07157D98]
          ncalrpc:[LRPC-24aef2f6fb7a88b25c]
          ncalrpc:[LRPC-8db1469658b5c125f4]
 
protocol: N/A 
provider: MPSSVC.dll 
uuid    : 2FB92682-6599-42DC-AE13-BD2CA89BD11C v1.0 Fw APIs
bindings: 
          ncalrpc:[LRPC-24aef2f6fb7a88b25c]
          ncalrpc:[LRPC-8db1469658b5c125f4]
 
protocol: N/A 
provider: N/A 
uuid    : F47433C3-3E9D-4157-AAD4-83AA1F5C2D4C v1.0 Fw APIs
bindings: 
          ncalrpc:[LRPC-24aef2f6fb7a88b25c]
          ncalrpc:[LRPC-8db1469658b5c125f4]
 
protocol: N/A 
provider: MPSSVC.dll 
uuid    : 7F9D11BF-7FB9-436B-A812-B2D50C5D4C03 v1.0 Fw APIs
bindings: 
          ncalrpc:[LRPC-24aef2f6fb7a88b25c]
          ncalrpc:[LRPC-8db1469658b5c125f4]
 
protocol: N/A 
provider: BFE.DLL 
uuid    : DD490425-5325-4565-B774-7E27D6C09C24 v1.0 Base Firewall Engine API
bindings: 
          ncalrpc:[LRPC-8db1469658b5c125f4]
 
protocol: N/A 
provider: efssvc.dll 
uuid    : 04EEB297-CBF4-466B-8A2A-BFD6A2F10BBA v1.0 EFSK RPC Interface
bindings: 
          ncacn_np:\\FUSE[\pipe\efsrpc]
          ncalrpc:[LRPC-c4dd745971f4799a7f]
 
protocol: N/A 
provider: efssvc.dll 
uuid    : DF1941C5-FE89-4E79-BF10-463657ACF44D v1.0 EFS RPC Interface
bindings: 
          ncacn_np:\\FUSE[\pipe\efsrpc]
          ncalrpc:[LRPC-c4dd745971f4799a7f]
 
protocol: [MS-NRPC]: Netlogon Remote Protocol 
provider: netlogon.dll 
uuid    : 12345678-1234-ABCD-EF00-01234567CFFB v1.0 
bindings: 
          ncalrpc:[NETLOGON_LRPC]
          ncacn_ip_tcp:10.10.10.193[49676]
          ncacn_np:\\FUSE[\pipe\b2966b67a16588b3]
          ncacn_http:10.10.10.193[49675]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE3D22714097A9CE240B574BD149AD]
          ncacn_ip_tcp:10.10.10.193[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\FUSE[\pipe\lsass]
 
protocol: [MS-RAA]: Remote Authorization API Protocol 
provider: N/A 
uuid    : 0B1C2170-5732-4E0E-8CD3-D9B16F3B84D7 v0.0 RemoteAccessCheck
bindings: 
          ncalrpc:[NETLOGON_LRPC]
          ncacn_ip_tcp:10.10.10.193[49676]
          ncacn_np:\\FUSE[\pipe\b2966b67a16588b3]
          ncacn_http:10.10.10.193[49675]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE3D22714097A9CE240B574BD149AD]
          ncacn_ip_tcp:10.10.10.193[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\FUSE[\pipe\lsass]
          ncalrpc:[NETLOGON_LRPC]
          ncacn_ip_tcp:10.10.10.193[49676]
          ncacn_np:\\FUSE[\pipe\b2966b67a16588b3]
          ncacn_http:10.10.10.193[49675]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE3D22714097A9CE240B574BD149AD]
          ncacn_ip_tcp:10.10.10.193[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\FUSE[\pipe\lsass]
 
protocol: [MS-LSAT]: Local Security Authority (Translation Methods) Remote 
provider: lsasrv.dll 
uuid    : 12345778-1234-ABCD-EF00-0123456789AB v0.0 
bindings: 
          ncacn_ip_tcp:10.10.10.193[49676]
          ncacn_np:\\FUSE[\pipe\b2966b67a16588b3]
          ncacn_http:10.10.10.193[49675]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE3D22714097A9CE240B574BD149AD]
          ncacn_ip_tcp:10.10.10.193[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\FUSE[\pipe\lsass]
 
protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol 
provider: samsrv.dll 
uuid    : 12345778-1234-ABCD-EF00-0123456789AC v1.0 
bindings: 
          ncacn_ip_tcp:10.10.10.193[49676]
          ncacn_np:\\FUSE[\pipe\b2966b67a16588b3]
          ncacn_http:10.10.10.193[49675]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE3D22714097A9CE240B574BD149AD]
          ncacn_ip_tcp:10.10.10.193[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\FUSE[\pipe\lsass]
 
protocol: [MS-DRSR]: Directory Replication Service (DRS) Remote Protocol 
provider: ntdsai.dll 
uuid    : E3514235-4B06-11D1-AB04-00C04FC2DCD2 v4.0 MS NT Directory DRS Interface
bindings: 
          ncacn_np:\\FUSE[\pipe\b2966b67a16588b3]
          ncacn_http:10.10.10.193[49675]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE3D22714097A9CE240B574BD149AD]
          ncacn_ip_tcp:10.10.10.193[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\FUSE[\pipe\lsass]
 
protocol: N/A 
provider: N/A 
uuid    : 1A0D010F-1C33-432C-B0F5-8CF4E8053099 v1.0 IdSegSrv service
bindings: 
          ncalrpc:[LRPC-bcb7135160d1c45f2f]
 
protocol: N/A 
provider: srvsvc.dll 
uuid    : 98716D03-89AC-44C7-BB8C-285824E51C4A v1.0 XactSrv service
bindings: 
          ncalrpc:[LRPC-bcb7135160d1c45f2f]
 
protocol: [MS-PAR]: Print System Asynchronous Remote Protocol 
provider: spoolsv.exe 
uuid    : 76F03F96-CDFD-44FC-A22C-64950A001209 v1.0 
bindings: 
          ncacn_ip_tcp:10.10.10.193[49680]
          ncalrpc:[LRPC-b864b3054262429087]
 
protocol: N/A 
provider: spoolsv.exe 
uuid    : 4A452661-8290-4B36-8FBE-7F4093A94978 v1.0 
bindings: 
          ncacn_ip_tcp:10.10.10.193[49680]
          ncalrpc:[LRPC-b864b3054262429087]
 
protocol: [MS-PAN]: Print System Asynchronous Notification Protocol 
provider: spoolsv.exe 
uuid    : AE33069B-A2A8-46EE-A235-DDFD339BE281 v1.0 
bindings: 
          ncacn_ip_tcp:10.10.10.193[49680]
          ncalrpc:[LRPC-b864b3054262429087]
 
protocol: [MS-PAN]: Print System Asynchronous Notification Protocol 
provider: spoolsv.exe 
uuid    : 0B6EDBFA-4A24-4FC6-8A23-942B1ECA65D1 v1.0 
bindings: 
          ncacn_ip_tcp:10.10.10.193[49680]
          ncalrpc:[LRPC-b864b3054262429087]
 
protocol: [MS-RPRN]: Print System Remote Protocol 
provider: spoolsv.exe 
uuid    : 12345678-1234-ABCD-EF00-0123456789AB v1.0 
bindings: 
          ncacn_ip_tcp:10.10.10.193[49680]
          ncalrpc:[LRPC-b864b3054262429087]
 
protocol: N/A 
provider: N/A 
uuid    : E38F5360-8572-473E-B696-1B46873BEEAB v1.0 
bindings: 
          ncalrpc:[LRPC-5945fb0b840d541346]
 
protocol: N/A 
provider: N/A 
uuid    : 4C9DBF19-D39E-4BB9-90EE-8F7179B20283 v1.0 
bindings: 
          ncalrpc:[LRPC-5945fb0b840d541346]
 
protocol: [MS-CMPO]: MSDTC Connection Manager: 
provider: msdtcprx.dll 
uuid    : 906B0CE0-C70B-1067-B317-00DD010662DA v1.0 
bindings: 
          ncalrpc:[LRPC-61aed806f5654907cf]
          ncalrpc:[OLE999A172707F833B3E13731A69E3A]
          ncalrpc:[LRPC-f815a61d257bca6761]
          ncalrpc:[LRPC-f815a61d257bca6761]
          ncalrpc:[LRPC-f815a61d257bca6761]
 
protocol: [MS-SCMR]: Service Control Manager Remote Protocol 
provider: services.exe 
uuid    : 367ABB81-9844-35F1-AD32-98F038001003 v2.0 
bindings: 
          ncacn_ip_tcp:10.10.10.193[49683]
 
protocol: N/A 
provider: winlogon.exe 
uuid    : 12E65DD8-887F-41EF-91BF-8D816C42C2E7 v1.0 Secure Desktop LRPC interface
bindings: 
          ncalrpc:[WMsgKRpc07D4C1]
 
protocol: [MS-DNSP]: Domain Name Service (DNS) Server Management 
provider: dns.exe 
uuid    : 50ABC2A4-574D-40B3-9D66-EE4FD5FBA076 v5.0 
bindings: 
          ncacn_ip_tcp:10.10.10.193[49694]
 
protocol: [MS-FRS2]: Distributed File System Replication Protocol 
provider: dfsrmig.exe 
uuid    : 897E2E5F-93F3-4376-9C9C-FD2277495C27 v1.0 Frs2 Service
bindings: 
          ncacn_ip_tcp:10.10.10.193[49701]
          ncalrpc:[OLE6587D1220619A917D8FAACFEFDEA]
 
[*] Received 299 endpoints.

impacket-rpcdump enumerated a total of 299 RPC endpoints Both [MS-PAR] and [MS-RPRN] are running from spoolsv.exe

IOXIDResolver

┌──(kali㉿kali)-[~/archive/htb/labs/fuse]
└─$ python3 IOXIDResolver.py -t $IP
[*] Retrieving network interface of 10.10.10.193
Address: Fuse
Address: 10.10.10.193
Address: dead:beef::b941:4d7d:7396:e75c
Address: dead:beef::bb

IOXIDResolver.py enumerated the hostname and 2 additional IPv6 addresses

IPv6

┌──(kali㉿kali)-[~/archive/htb/labs/fuse]
└─$ rustscan -a dead:beef::b941:4d7d:7396:e75c -b 10000
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
😵 https://admin.tryhackme.com
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
open [dead:beef::b941:4d7d:7396:e75c]:53
open [dead:beef::b941:4d7d:7396:e75c]:80
open [dead:beef::b941:4d7d:7396:e75c]:88
open [dead:beef::b941:4d7d:7396:e75c]:135
open [dead:beef::b941:4d7d:7396:e75c]:389
open [dead:beef::b941:4d7d:7396:e75c]:445
open [dead:beef::b941:4d7d:7396:e75c]:593
open [dead:beef::b941:4d7d:7396:e75c]:636
open [dead:beef::b941:4d7d:7396:e75c]:3268
open [dead:beef::b941:4d7d:7396:e75c]:3269
open [dead:beef::b941:4d7d:7396:e75c]:464
open [dead:beef::b941:4d7d:7396:e75c]:5985
open [dead:beef::b941:4d7d:7396:e75c]:9389
open [dead:beef::b941:4d7d:7396:e75c]:49666
open [dead:beef::b941:4d7d:7396:e75c]:49680
open [dead:beef::b941:4d7d:7396:e75c]:49676
open [dead:beef::b941:4d7d:7396:e75c]:49667
open [dead:beef::b941:4d7d:7396:e75c]:49675
open [dead:beef::b941:4d7d:7396:e75c]:49694
open [dead:beef::b941:4d7d:7396:e75c]:49701
 
┌──(kali㉿kali)-[~/archive/htb/labs/fuse]
└─$ rustscan -a dead:beef::bb -b 10000
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
😵 https://admin.tryhackme.com
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
open [dead:beef::bb]:53
open [dead:beef::bb]:80
open [dead:beef::bb]:88
open [dead:beef::bb]:135
open [dead:beef::bb]:389
open [dead:beef::bb]:445
open [dead:beef::bb]:464
open [dead:beef::bb]:593
open [dead:beef::bb]:3268
open [dead:beef::bb]:3269
open [dead:beef::bb]:5985
open [dead:beef::bb]:9389
open [dead:beef::bb]:49667
open [dead:beef::bb]:49666
open [dead:beef::bb]:49676
open [dead:beef::bb]:49680
open [dead:beef::bb]:49675
open [dead:beef::bb]:49694
open [dead:beef::bb]:49701

It doesn’t seem like these IPv6 are running any additional services

Interactive Graph View

Backlinks