InfoSec LAB

Intelligence_MSRPC

Created: 6 min read

MSRPC

Nmap discovered a MSRPC service on the target port 135 and 593 The running service is Microsoft Windows RPC

┌──(kali㉿kali)-[~/archive/htb/labs/intelligence]
└─$ rpcclient $IP -N -U ''
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> lsaenumsid
result was NT_STATUS_ACCESS_DENIED
rpcclient $> enumprinters
do_cmd: Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> querydominfo
result was NT_STATUS_ACCESS_DENIED
rpcclient $> netshareenumall
do_cmd: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> dsroledominfo
Machine Role = [5]
Directory Service is running.
Domain is in native mode.
rpcclient $> lsaquery
domain name: intelligence
domain sid: S-1-5-21-4210132550-3389855604-3437519686

While the target MSRPC server allows anonymous access, lack of privileges limits enumeration The domain SID is S-1-5-21-4210132550-3389855604-3437519686

RPC Endpoints

┌──(kali㉿kali)-[~/archive/htb/labs/intelligence]
└─$ impacket-rpcdump $IP
Impacket v0.11.0 - Copyright 2023 Fortra
 
[*] Retrieving endpoint list from 10.10.10.248
Protocol: [MS-RSP]: Remote Shutdown Protocol 
Provider: wininit.exe 
UUID    : D95AFE70-A6D5-4259-822E-2C84DA1DDB0D v1.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.248[49664]
          ncalrpc:[WindowsShutdown]
          ncacn_np:\\DC[\PIPE\InitShutdown]
          ncalrpc:[WMsgKRpc0955B0]
 
Protocol: N/A 
Provider: winlogon.exe 
UUID    : 76F226C3-EC14-4325-8A99-6A46348418AF v1.0 
Bindings: 
          ncalrpc:[WindowsShutdown]
          ncacn_np:\\DC[\PIPE\InitShutdown]
          ncalrpc:[WMsgKRpc0955B0]
          ncalrpc:[WMsgKRpc0974F1]
 
Protocol: N/A 
Provider: sysntfy.dll 
UUID    : C9AC6DB5-82B7-4E55-AE8A-E464ED7B4277 v1.0 Impl friendly name
Bindings: 
          ncalrpc:[LRPC-dd511f7825060e07e0]
          ncalrpc:[LRPC-a459d82e6daccadd1b]
          ncalrpc:[IUserProfile2]
          ncalrpc:[LRPC-8b490b2050af232c54]
          ncalrpc:[senssvc]
          ncalrpc:[OLE61A6392923B5F450E5BD95D03F40]
          ncacn_ip_tcp:10.10.10.248[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\DC[\pipe\lsass]
 
Protocol: N/A 
Provider: N/A 
UUID    : D09BDEB5-6171-4A34-BFE2-06FA82652568 v1.0 
Bindings: 
          ncalrpc:[csebpub]
          ncalrpc:[LRPC-95cf75139265a66eb9]
          ncalrpc:[LRPC-2f0995bb99e88d2e0c]
          ncalrpc:[LRPC-efc631e7495efc09f4]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
          ncalrpc:[LRPC-2f0995bb99e88d2e0c]
          ncalrpc:[LRPC-efc631e7495efc09f4]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
          ncalrpc:[LRPC-efc631e7495efc09f4]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
          ncalrpc:[LRPC-11bdeb958dd7f5b988]
 
Protocol: N/A 
Provider: N/A 
UUID    : 697DCDA9-3BA9-4EB2-9247-E11F1901B0D2 v1.0 
Bindings: 
          ncalrpc:[LRPC-95cf75139265a66eb9]
          ncalrpc:[LRPC-2f0995bb99e88d2e0c]
          ncalrpc:[LRPC-efc631e7495efc09f4]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
Protocol: N/A 
Provider: N/A 
UUID    : 9B008953-F195-4BF9-BDE0-4471971E58ED v1.0 
Bindings: 
          ncalrpc:[LRPC-2f0995bb99e88d2e0c]
          ncalrpc:[LRPC-efc631e7495efc09f4]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
Protocol: N/A 
Provider: nsisvc.dll 
UUID    : 7EA70BCF-48AF-4F6A-8968-6A440754D5FA v1.0 NSI server endpoint
Bindings: 
          ncalrpc:[LRPC-84a8143e3f3767f2fd]
 
Protocol: [MS-EVEN6]: EventLog Remoting Protocol 
Provider: wevtsvc.dll 
UUID    : F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C v1.0 Event log TCPIP
Bindings: 
          ncacn_ip_tcp:10.10.10.248[49665]
          ncacn_np:\\DC[\pipe\eventlog]
          ncalrpc:[eventlog]
 
Protocol: N/A 
Provider: gpsvc.dll 
UUID    : 2EB08E3E-639F-4FBA-97B1-14F878961076 v1.0 Group Policy RPC Interface
Bindings: 
          ncalrpc:[LRPC-bd65ed0246a4f0239b]
 
Protocol: N/A 
Provider: dhcpcsvc.dll 
UUID    : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D5 v1.0 DHCP Client LRPC Endpoint
Bindings: 
          ncalrpc:[dhcpcsvc]
          ncalrpc:[dhcpcsvc6]
 
Protocol: N/A 
Provider: dhcpcsvc6.dll 
UUID    : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D6 v1.0 DHCPv6 Client LRPC Endpoint
Bindings: 
          ncalrpc:[dhcpcsvc6]
 
Protocol: N/A 
Provider: N/A 
UUID    : 3A9EF155-691D-4449-8D05-09AD57031823 v1.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.248[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\DC[\PIPE\atsvc]
          ncalrpc:[LRPC-f4e43a0985b967e0aa]
 
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol 
Provider: schedsvc.dll 
UUID    : 86D35949-83C9-4044-B424-DB363231FD0C v1.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.248[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\DC[\PIPE\atsvc]
          ncalrpc:[LRPC-f4e43a0985b967e0aa]
 
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol 
Provider: taskcomp.dll 
UUID    : 378E52B0-C0A9-11CF-822D-00AA0051E40F v1.0 
Bindings: 
          ncacn_np:\\DC[\PIPE\atsvc]
          ncalrpc:[LRPC-f4e43a0985b967e0aa]
 
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol 
Provider: taskcomp.dll 
UUID    : 1FF70682-0A51-30E8-076D-740BE8CEE98B v1.0 
Bindings: 
          ncacn_np:\\DC[\PIPE\atsvc]
          ncalrpc:[LRPC-f4e43a0985b967e0aa]
 
Protocol: N/A 
Provider: schedsvc.dll 
UUID    : 0A74EF1C-41A4-4E06-83AE-DC74FB1CDD53 v1.0 
Bindings: 
          ncalrpc:[LRPC-f4e43a0985b967e0aa]
 
Protocol: N/A 
Provider: N/A 
UUID    : 7F1343FE-50A9-4927-A778-0C5859517BAC v1.0 DfsDs service
Bindings: 
          ncacn_np:\\DC[\PIPE\wkssvc]
          ncalrpc:[LRPC-ee2121b2441d8f67b4]
 
Protocol: N/A 
Provider: N/A 
UUID    : EB081A0D-10EE-478A-A1DD-50995283E7A8 v3.0 Witness Client Test Interface
Bindings: 
          ncalrpc:[LRPC-ee2121b2441d8f67b4]
 
Protocol: N/A 
Provider: N/A 
UUID    : F2C9B409-C1C9-4100-8639-D8AB1486694A v1.0 Witness Client Upcall Server
Bindings: 
          ncalrpc:[LRPC-ee2121b2441d8f67b4]
 
Protocol: N/A 
Provider: MPSSVC.dll 
UUID    : 2FB92682-6599-42DC-AE13-BD2CA89BD11C v1.0 Fw APIs
Bindings: 
          ncalrpc:[LRPC-2baa25b2ec03bfc75b]
          ncalrpc:[LRPC-65cdbcbdc56f39d389]
          ncalrpc:[LRPC-92627b0ea4cad66839]
          ncalrpc:[LRPC-61d226769499de3994]
 
Protocol: N/A 
Provider: N/A 
UUID    : F47433C3-3E9D-4157-AAD4-83AA1F5C2D4C v1.0 Fw APIs
Bindings: 
          ncalrpc:[LRPC-65cdbcbdc56f39d389]
          ncalrpc:[LRPC-92627b0ea4cad66839]
          ncalrpc:[LRPC-61d226769499de3994]
 
Protocol: N/A 
Provider: MPSSVC.dll 
UUID    : 7F9D11BF-7FB9-436B-A812-B2D50C5D4C03 v1.0 Fw APIs
Bindings: 
          ncalrpc:[LRPC-92627b0ea4cad66839]
          ncalrpc:[LRPC-61d226769499de3994]
 
Protocol: N/A 
Provider: BFE.DLL 
UUID    : DD490425-5325-4565-B774-7E27D6C09C24 v1.0 Base Firewall Engine API
Bindings: 
          ncalrpc:[LRPC-61d226769499de3994]
 
Protocol: N/A 
Provider: N/A 
UUID    : A500D4C6-0DD1-4543-BC0C-D5F93486EAF8 v1.0 
Bindings: 
          ncalrpc:[LRPC-f26992472d795f2b56]
          ncalrpc:[LRPC-11bdeb958dd7f5b988]
 
Protocol: N/A 
Provider: N/A 
UUID    : 3473DD4D-2E88-4006-9CBA-22570909DD10 v5.1 WinHttp Auto-Proxy Service
Bindings: 
          ncalrpc:[2248ed9c-6ea6-43bf-a2a6-21f3a0693b15]
          ncalrpc:[LRPC-cbd393ab390f7dbadd]
 
Protocol: N/A 
Provider: N/A 
UUID    : C49A5A70-8A7F-4E70-BA16-1E8F1F193EF1 v1.0 Adh APIs
Bindings: 
          ncalrpc:[OLECD92E16D5C679DCD76A26F0CCB2B]
          ncalrpc:[TeredoControl]
          ncalrpc:[TeredoDiagnostics]
          ncalrpc:[LRPC-eb8b94c47a2c37942f]
 
Protocol: N/A 
Provider: N/A 
UUID    : C36BE077-E14B-4FE9-8ABC-E856EF4F048B v1.0 Proxy Manager client server endpoint
Bindings: 
          ncalrpc:[TeredoControl]
          ncalrpc:[TeredoDiagnostics]
          ncalrpc:[LRPC-eb8b94c47a2c37942f]
 
Protocol: N/A 
Provider: N/A 
UUID    : 2E6035B2-E8F1-41A7-A044-656B439C4C34 v1.0 Proxy Manager provider server endpoint
Bindings: 
          ncalrpc:[TeredoControl]
          ncalrpc:[TeredoDiagnostics]
          ncalrpc:[LRPC-eb8b94c47a2c37942f]
 
Protocol: N/A 
Provider: iphlpsvc.dll 
UUID    : 552D076A-CB29-4E44-8B6A-D15E59E2C0AF v1.0 IP Transition Configuration endpoint
Bindings: 
          ncalrpc:[LRPC-eb8b94c47a2c37942f]
 
Protocol: N/A 
Provider: N/A 
UUID    : 0D3C7F20-1C8D-4654-A1B3-51563B298BDA v1.0 UserMgrCli
Bindings: 
          ncalrpc:[LRPC-a65199975fc0dc17fd]
          ncalrpc:[OLEE30CBE723B3B6F742C6EDFAF8E44]
 
Protocol: N/A 
Provider: N/A 
UUID    : B18FBAB6-56F8-4702-84E0-41053293A869 v1.0 UserMgrCli
Bindings: 
          ncalrpc:[LRPC-a65199975fc0dc17fd]
          ncalrpc:[OLEE30CBE723B3B6F742C6EDFAF8E44]
 
Protocol: N/A 
Provider: N/A 
UUID    : 51A227AE-825B-41F2-B4A9-1AC9557A1018 v1.0 Ngc Pop Key Service
Bindings: 
          ncalrpc:[NETLOGON_LRPC]
          ncacn_ip_tcp:10.10.10.248[49692]
          ncacn_np:\\DC[\pipe\b0e7c7b12877ee66]
          ncacn_http:10.10.10.248[49691]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE61A6392923B5F450E5BD95D03F40]
          ncacn_ip_tcp:10.10.10.248[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\DC[\pipe\lsass]
 
Protocol: N/A 
Provider: N/A 
UUID    : 8FB74744-B2FF-4C00-BE0D-9EF9A191FE1B v1.0 Ngc Pop Key Service
Bindings: 
          ncalrpc:[NETLOGON_LRPC]
          ncacn_ip_tcp:10.10.10.248[49692]
          ncacn_np:\\DC[\pipe\b0e7c7b12877ee66]
          ncacn_http:10.10.10.248[49691]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE61A6392923B5F450E5BD95D03F40]
          ncacn_ip_tcp:10.10.10.248[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\DC[\pipe\lsass]
 
Protocol: N/A 
Provider: N/A 
UUID    : B25A52BF-E5DD-4F4A-AEA6-8CA7272A0E86 v2.0 KeyIso
Bindings: 
          ncalrpc:[NETLOGON_LRPC]
          ncacn_ip_tcp:10.10.10.248[49692]
          ncacn_np:\\DC[\pipe\b0e7c7b12877ee66]
          ncacn_http:10.10.10.248[49691]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE61A6392923B5F450E5BD95D03F40]
          ncacn_ip_tcp:10.10.10.248[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\DC[\pipe\lsass]
 
Protocol: N/A 
Provider: efssvc.dll 
UUID    : 04EEB297-CBF4-466B-8A2A-BFD6A2F10BBA v1.0 EFSK RPC Interface
Bindings: 
          ncacn_np:\\DC[\pipe\efsrpc]
          ncalrpc:[LRPC-81e9f85a9de3057940]
 
Protocol: N/A 
Provider: efssvc.dll 
UUID    : DF1941C5-FE89-4E79-BF10-463657ACF44D v1.0 EFS RPC Interface
Bindings: 
          ncacn_np:\\DC[\pipe\efsrpc]
          ncalrpc:[LRPC-81e9f85a9de3057940]
 
Protocol: [MS-NRPC]: Netlogon Remote Protocol 
Provider: netlogon.dll 
UUID    : 12345678-1234-ABCD-EF00-01234567CFFB v1.0 
Bindings: 
          ncalrpc:[NETLOGON_LRPC]
          ncacn_ip_tcp:10.10.10.248[49692]
          ncacn_np:\\DC[\pipe\b0e7c7b12877ee66]
          ncacn_http:10.10.10.248[49691]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE61A6392923B5F450E5BD95D03F40]
          ncacn_ip_tcp:10.10.10.248[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\DC[\pipe\lsass]
 
Protocol: [MS-RAA]: Remote Authorization API Protocol 
Provider: N/A 
UUID    : 0B1C2170-5732-4E0E-8CD3-D9B16F3B84D7 v0.0 RemoteAccessCheck
Bindings: 
          ncalrpc:[NETLOGON_LRPC]
          ncacn_ip_tcp:10.10.10.248[49692]
          ncacn_np:\\DC[\pipe\b0e7c7b12877ee66]
          ncacn_http:10.10.10.248[49691]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE61A6392923B5F450E5BD95D03F40]
          ncacn_ip_tcp:10.10.10.248[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\DC[\pipe\lsass]
          ncalrpc:[NETLOGON_LRPC]
          ncacn_ip_tcp:10.10.10.248[49692]
          ncacn_np:\\DC[\pipe\b0e7c7b12877ee66]
          ncacn_http:10.10.10.248[49691]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE61A6392923B5F450E5BD95D03F40]
          ncacn_ip_tcp:10.10.10.248[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\DC[\pipe\lsass]
 
Protocol: [MS-LSAT]: Local Security Authority (Translation Methods) Remote 
Provider: lsasrv.dll 
UUID    : 12345778-1234-ABCD-EF00-0123456789AB v0.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.248[49692]
          ncacn_np:\\DC[\pipe\b0e7c7b12877ee66]
          ncacn_http:10.10.10.248[49691]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE61A6392923B5F450E5BD95D03F40]
          ncacn_ip_tcp:10.10.10.248[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\DC[\pipe\lsass]
 
Protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol 
Provider: samsrv.dll 
UUID    : 12345778-1234-ABCD-EF00-0123456789AC v1.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.248[49692]
          ncacn_np:\\DC[\pipe\b0e7c7b12877ee66]
          ncacn_http:10.10.10.248[49691]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE61A6392923B5F450E5BD95D03F40]
          ncacn_ip_tcp:10.10.10.248[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\DC[\pipe\lsass]
 
Protocol: [MS-DRSR]: Directory Replication Service (DRS) Remote Protocol 
Provider: ntdsai.dll 
UUID    : E3514235-4B06-11D1-AB04-00C04FC2DCD2 v4.0 MS NT Directory DRS Interface
Bindings: 
          ncacn_np:\\DC[\pipe\b0e7c7b12877ee66]
          ncacn_http:10.10.10.248[49691]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLE61A6392923B5F450E5BD95D03F40]
          ncacn_ip_tcp:10.10.10.248[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\DC[\pipe\lsass]
 
Protocol: N/A 
Provider: N/A 
UUID    : 1A0D010F-1C33-432C-B0F5-8CF4E8053099 v1.0 IdSegSrv service
Bindings: 
          ncalrpc:[LRPC-17a084839be274ec95]
 
Protocol: N/A 
Provider: srvsvc.dll 
UUID    : 98716D03-89AC-44C7-BB8C-285824E51C4A v1.0 XactSrv service
Bindings: 
          ncalrpc:[LRPC-17a084839be274ec95]
 
Protocol: N/A 
Provider: N/A 
UUID    : DF4DF73A-C52D-4E3A-8003-8437FDF8302A v0.0 WM_WindowManagerRPC\Server
Bindings: 
          ncalrpc:[LRPC-bba6822c333f39c4b9]
 
Protocol: N/A 
Provider: sysmain.dll 
UUID    : B58AA02E-2884-4E97-8176-4EE06D794184 v1.0 
Bindings: 
          ncalrpc:[LRPC-9513ea228d12ce3df3]
 
Protocol: [MS-SCMR]: Service Control Manager Remote Protocol 
Provider: services.exe 
UUID    : 367ABB81-9844-35F1-AD32-98F038001003 v2.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.248[49696]
 
Protocol: [MS-CMPO]: MSDTC Connection Manager: 
Provider: msdtcprx.dll 
UUID    : 906B0CE0-C70B-1067-B317-00DD010662DA v1.0 
Bindings: 
          ncalrpc:[LRPC-4866900d1bb38c7638]
          ncalrpc:[OLE5DD35ADEA53F9A937F8765BCA053]
          ncalrpc:[LRPC-73d8d770d6881606b0]
          ncalrpc:[LRPC-73d8d770d6881606b0]
          ncalrpc:[LRPC-73d8d770d6881606b0]
 
Protocol: N/A 
Provider: N/A 
UUID    : F3F09FFD-FBCF-4291-944D-70AD6E0E73BB v1.0 
Bindings: 
          ncalrpc:[LRPC-0c1395e40084b8a724]
 
Protocol: N/A 
Provider: N/A 
UUID    : 98CD761E-E77D-41C8-A3C0-0FB756D90EC2 v1.0 
Bindings: 
          ncalrpc:[LRPC-e835f15517ddcb47d1]
 
Protocol: N/A 
Provider: N/A 
UUID    : D22895EF-AFF4-42C5-A5B2-B14466D34AB4 v1.0 
Bindings: 
          ncalrpc:[LRPC-e835f15517ddcb47d1]
 
Protocol: N/A 
Provider: N/A 
UUID    : E38F5360-8572-473E-B696-1B46873BEEAB v1.0 
Bindings: 
          ncalrpc:[LRPC-e835f15517ddcb47d1]
 
Protocol: N/A 
Provider: N/A 
UUID    : 95095EC8-32EA-4EB0-A3E2-041F97B36168 v1.0 
Bindings: 
          ncalrpc:[LRPC-e835f15517ddcb47d1]
 
Protocol: N/A 
Provider: N/A 
UUID    : FD8BE72B-A9CD-4B2C-A9CA-4DED242FBE4D v1.0 
Bindings: 
          ncalrpc:[LRPC-e835f15517ddcb47d1]
 
Protocol: N/A 
Provider: N/A 
UUID    : 4C9DBF19-D39E-4BB9-90EE-8F7179B20283 v1.0 
Bindings: 
          ncalrpc:[LRPC-e835f15517ddcb47d1]
 
Protocol: [MS-ICPR]: ICertPassage Remote Protocol 
Provider: certsrv.exe 
UUID    : 91AE6020-9E3C-11CF-8D7C-00AA00C091BE v0.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.248[49702]
          ncacn_np:\\DC[\pipe\cert]
          ncalrpc:[OLEEC9C77E22BC9662ABC88F8842E9B]
 
Protocol: N/A 
Provider: nrpsrv.dll 
UUID    : 30ADC50C-5CBC-46CE-9A0E-91914789E23C v1.0 NRP server endpoint
Bindings: 
          ncalrpc:[LRPC-322fec3126ab86d7d0]
 
Protocol: [MS-DNSP]: Domain Name Service (DNS) Server Management 
Provider: dns.exe 
UUID    : 50ABC2A4-574D-40B3-9D66-EE4FD5FBA076 v5.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.248[49714]
 
Protocol: [MS-FRS2]: Distributed File System Replication Protocol 
Provider: dfsrmig.exe 
UUID    : 897E2E5F-93F3-4376-9C9C-FD2277495C27 v1.0 Frs2 Service
Bindings: 
          ncacn_ip_tcp:10.10.10.248[58533]
          ncalrpc:[OLE2C43EB85F8E1EE1B22797DAF6AAA]
 
[*] Received 289 endpoints.

impacket-rpcdump enumerated a total of 289 RPC endpoints

IOXIDResolver

┌──(kali㉿kali)-[~/archive/htb/labs/intelligence]
└─$ python3 IOXIDResolver.py -t $IP    
[*] Retrieving network interface of 10.10.10.248
address: dc
address: 10.10.10.248
address: dead:beef::95e:6ab2:ad09:42c7
address: dead:beef::23b

IOXIDResolver.py also found those 2 additional IPv6 addresses

Interactive Graph View

Backlinks