MSRPC
Nmap discovered a MSRPC service on the target port 135
┌──(kali㉿kali)-[~/archive/htb/labs/netmon]
└─$ rpcclient $IP -N -U ''
Cannot connect to server. Error was NT_STATUS_ACCESS_DENIEDThe target MSRPC service does not allow anonymous access
RPC Endpoints
┌──(kali㉿kali)-[~/archive/htb/labs/netmon]
└─$ impacket-rpcdump $IP 1 ⨯
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Retrieving endpoint list from 10.10.10.152
Protocol: [MS-RSP]: Remote Shutdown Protocol
Provider: wininit.exe
UUID : D95AFE70-A6D5-4259-822E-2C84DA1DDB0D v1.0
Bindings:
ncacn_ip_tcp:10.10.10.152[49664]
ncalrpc:[WindowsShutdown]
ncacn_np:\\NETMON[\PIPE\InitShutdown]
ncalrpc:[WMsgKRpc071A10]
Protocol: N/A
Provider: winlogon.exe
UUID : 76F226C3-EC14-4325-8A99-6A46348418AF v1.0
Bindings:
ncalrpc:[WindowsShutdown]
ncacn_np:\\NETMON[\PIPE\InitShutdown]
ncalrpc:[WMsgKRpc071A10]
ncalrpc:[WMsgKRpc071D61]
Protocol: N/A
Provider: N/A
UUID : D09BDEB5-6171-4A34-BFE2-06FA82652568 v1.0
Bindings:
ncalrpc:[csebpub]
ncalrpc:[LRPC-d8e842d5019d6c6995]
ncalrpc:[LRPC-476a826017b310b986]
ncacn_np:\\NETMON[\pipe\LSM_API_service]
ncalrpc:[LSMApi]
ncalrpc:[LRPC-fc7527f9f94b2886fe]
ncalrpc:[actkernel]
ncalrpc:[umpo]
ncalrpc:[LRPC-476a826017b310b986]
ncacn_np:\\NETMON[\pipe\LSM_API_service]
ncalrpc:[LSMApi]
ncalrpc:[LRPC-fc7527f9f94b2886fe]
ncalrpc:[actkernel]
ncalrpc:[umpo]
ncalrpc:[LRPC-3d94b42cf15bfb75a6]
ncalrpc:[dhcpcsvc6]
ncalrpc:[dhcpcsvc]
ncacn_ip_tcp:10.10.10.152[49665]
ncacn_np:\\NETMON[\pipe\eventlog]
ncalrpc:[eventlog]
ncalrpc:[LRPC-da0f1e5fd67def451b]
Protocol: N/A
Provider: N/A
UUID : 697DCDA9-3BA9-4EB2-9247-E11F1901B0D2 v1.0
Bindings:
ncalrpc:[LRPC-d8e842d5019d6c6995]
ncalrpc:[LRPC-476a826017b310b986]
ncacn_np:\\NETMON[\pipe\LSM_API_service]
ncalrpc:[LSMApi]
ncalrpc:[LRPC-fc7527f9f94b2886fe]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: sysntfy.dll
UUID : C9AC6DB5-82B7-4E55-AE8A-E464ED7B4277 v1.0 Impl friendly name
Bindings:
ncalrpc:[LRPC-fc7527f9f94b2886fe]
ncalrpc:[actkernel]
ncalrpc:[umpo]
ncalrpc:[senssvc]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
ncalrpc:[IUserProfile2]
Protocol: N/A
Provider: nrpsrv.dll
UUID : 30ADC50C-5CBC-46CE-9A0E-91914789E23C v1.0 NRP server endpoint
Bindings:
ncalrpc:[LRPC-90bbaf8ba5214ebc35]
ncalrpc:[LRPC-3d94b42cf15bfb75a6]
ncalrpc:[dhcpcsvc6]
ncalrpc:[dhcpcsvc]
ncacn_ip_tcp:10.10.10.152[49665]
ncacn_np:\\NETMON[\pipe\eventlog]
ncalrpc:[eventlog]
ncalrpc:[LRPC-da0f1e5fd67def451b]
Protocol: N/A
Provider: N/A
UUID : A500D4C6-0DD1-4543-BC0C-D5F93486EAF8 v1.0
Bindings:
ncalrpc:[LRPC-90bbaf8ba5214ebc35]
ncalrpc:[LRPC-3d94b42cf15bfb75a6]
ncalrpc:[dhcpcsvc6]
ncalrpc:[dhcpcsvc]
ncacn_ip_tcp:10.10.10.152[49665]
ncacn_np:\\NETMON[\pipe\eventlog]
ncalrpc:[eventlog]
ncalrpc:[LRPC-da0f1e5fd67def451b]
Protocol: N/A
Provider: dhcpcsvc6.dll
UUID : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D6 v1.0 DHCPv6 Client LRPC Endpoint
Bindings:
ncalrpc:[dhcpcsvc6]
ncalrpc:[dhcpcsvc]
ncacn_ip_tcp:10.10.10.152[49665]
ncacn_np:\\NETMON[\pipe\eventlog]
ncalrpc:[eventlog]
ncalrpc:[LRPC-da0f1e5fd67def451b]
Protocol: N/A
Provider: dhcpcsvc.dll
UUID : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D5 v1.0 DHCP Client LRPC Endpoint
Bindings:
ncalrpc:[dhcpcsvc]
ncacn_ip_tcp:10.10.10.152[49665]
ncacn_np:\\NETMON[\pipe\eventlog]
ncalrpc:[eventlog]
ncalrpc:[LRPC-da0f1e5fd67def451b]
Protocol: [MS-EVEN6]: EventLog Remoting Protocol
Provider: wevtsvc.dll
UUID : F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C v1.0 Event log TCPIP
Bindings:
ncacn_ip_tcp:10.10.10.152[49665]
ncacn_np:\\NETMON[\pipe\eventlog]
ncalrpc:[eventlog]
ncalrpc:[LRPC-da0f1e5fd67def451b]
Protocol: N/A
Provider: IKEEXT.DLL
UUID : A398E520-D59A-4BDD-AA7A-3C1E0303A511 v1.0 IKE/Authip API
Bindings:
ncalrpc:[LRPC-9ef4d94e919105ebcd]
ncacn_ip_tcp:10.10.10.152[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\NETMON[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
Protocol: N/A
Provider: N/A
UUID : C49A5A70-8A7F-4E70-BA16-1E8F1F193EF1 v1.0 Adh APIs
Bindings:
ncalrpc:[LRPC-9ef4d94e919105ebcd]
ncacn_ip_tcp:10.10.10.152[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\NETMON[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
Protocol: N/A
Provider: N/A
UUID : C36BE077-E14B-4FE9-8ABC-E856EF4F048B v1.0 Proxy Manager client server endpoint
Bindings:
ncalrpc:[LRPC-9ef4d94e919105ebcd]
ncacn_ip_tcp:10.10.10.152[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\NETMON[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
Protocol: N/A
Provider: N/A
UUID : 2E6035B2-E8F1-41A7-A044-656B439C4C34 v1.0 Proxy Manager provider server endpoint
Bindings:
ncalrpc:[LRPC-9ef4d94e919105ebcd]
ncacn_ip_tcp:10.10.10.152[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\NETMON[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
Protocol: N/A
Provider: iphlpsvc.dll
UUID : 552D076A-CB29-4E44-8B6A-D15E59E2C0AF v1.0 IP Transition Configuration endpoint
Bindings:
ncalrpc:[LRPC-9ef4d94e919105ebcd]
ncacn_ip_tcp:10.10.10.152[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\NETMON[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
Protocol: N/A
Provider: N/A
UUID : 0D3C7F20-1C8D-4654-A1B3-51563B298BDA v1.0 UserMgrCli
Bindings:
ncalrpc:[LRPC-9ef4d94e919105ebcd]
ncacn_ip_tcp:10.10.10.152[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\NETMON[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
Protocol: N/A
Provider: N/A
UUID : B18FBAB6-56F8-4702-84E0-41053293A869 v1.0 UserMgrCli
Bindings:
ncalrpc:[LRPC-9ef4d94e919105ebcd]
ncacn_ip_tcp:10.10.10.152[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\NETMON[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
Protocol: N/A
Provider: N/A
UUID : 3A9EF155-691D-4449-8D05-09AD57031823 v1.0
Bindings:
ncacn_ip_tcp:10.10.10.152[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\NETMON[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
Provider: schedsvc.dll
UUID : 86D35949-83C9-4044-B424-DB363231FD0C v1.0
Bindings:
ncacn_ip_tcp:10.10.10.152[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\NETMON[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
Provider: taskcomp.dll
UUID : 378E52B0-C0A9-11CF-822D-00AA0051E40F v1.0
Bindings:
ncacn_np:\\NETMON[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
Provider: taskcomp.dll
UUID : 1FF70682-0A51-30E8-076D-740BE8CEE98B v1.0
Bindings:
ncacn_np:\\NETMON[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
Protocol: N/A
Provider: schedsvc.dll
UUID : 0A74EF1C-41A4-4E06-83AE-DC74FB1CDD53 v1.0
Bindings:
ncalrpc:[senssvc]
ncalrpc:[OLEEC628B4F75B21535E0D02A0C2850]
ncalrpc:[IUserProfile2]
Protocol: N/A
Provider: gpsvc.dll
UUID : 2EB08E3E-639F-4FBA-97B1-14F878961076 v1.0 Group Policy RPC Interface
Bindings:
ncalrpc:[LRPC-3f70a8652f646897f3]
Protocol: N/A
Provider: N/A
UUID : 3473DD4D-2E88-4006-9CBA-22570909DD10 v5.1 WinHttp Auto-Proxy Service
Bindings:
ncalrpc:[LRPC-f1f8b26e1b7065463a]
ncalrpc:[OLEBA1EAC3F45D0FF15F60ED1DC8FFD]
Protocol: N/A
Provider: nsisvc.dll
UUID : 7EA70BCF-48AF-4F6A-8968-6A440754D5FA v1.0 NSI server endpoint
Bindings:
ncalrpc:[LRPC-f1f8b26e1b7065463a]
ncalrpc:[OLEBA1EAC3F45D0FF15F60ED1DC8FFD]
Protocol: N/A
Provider: N/A
UUID : 7F1343FE-50A9-4927-A778-0C5859517BAC v1.0 DfsDs service
Bindings:
ncacn_np:\\NETMON[\PIPE\wkssvc]
ncalrpc:[LRPC-6cf574cf2f2069696e]
Protocol: N/A
Provider: N/A
UUID : EB081A0D-10EE-478A-A1DD-50995283E7A8 v3.0 Witness Client Test Interface
Bindings:
ncalrpc:[LRPC-6cf574cf2f2069696e]
Protocol: N/A
Provider: N/A
UUID : F2C9B409-C1C9-4100-8639-D8AB1486694A v1.0 Witness Client Upcall Server
Bindings:
ncalrpc:[LRPC-6cf574cf2f2069696e]
Protocol: N/A
Provider: MPSSVC.dll
UUID : 2FB92682-6599-42DC-AE13-BD2CA89BD11C v1.0 Fw APIs
Bindings:
ncalrpc:[LRPC-0b081eda803f798424]
ncalrpc:[LRPC-e3fcb6995647840b2b]
ncalrpc:[LRPC-22df8676f6419f8fbc]
Protocol: N/A
Provider: N/A
UUID : F47433C3-3E9D-4157-AAD4-83AA1F5C2D4C v1.0 Fw APIs
Bindings:
ncalrpc:[LRPC-0b081eda803f798424]
ncalrpc:[LRPC-e3fcb6995647840b2b]
ncalrpc:[LRPC-22df8676f6419f8fbc]
Protocol: N/A
Provider: MPSSVC.dll
UUID : 7F9D11BF-7FB9-436B-A812-B2D50C5D4C03 v1.0 Fw APIs
Bindings:
ncalrpc:[LRPC-0b081eda803f798424]
ncalrpc:[LRPC-e3fcb6995647840b2b]
ncalrpc:[LRPC-22df8676f6419f8fbc]
Protocol: N/A
Provider: N/A
UUID : DF4DF73A-C52D-4E3A-8003-8437FDF8302A v0.0 WM_WindowManagerRPC\Server
Bindings:
ncalrpc:[LRPC-e3fcb6995647840b2b]
ncalrpc:[LRPC-22df8676f6419f8fbc]
Protocol: N/A
Provider: BFE.DLL
UUID : DD490425-5325-4565-B774-7E27D6C09C24 v1.0 Base Firewall Engine API
Bindings:
ncalrpc:[LRPC-22df8676f6419f8fbc]
Protocol: N/A
Provider: N/A
UUID : 1A0D010F-1C33-432C-B0F5-8CF4E8053099 v1.0 IdSegSrv service
Bindings:
ncalrpc:[LRPC-71a41a1021ac473a05]
Protocol: N/A
Provider: srvsvc.dll
UUID : 98716D03-89AC-44C7-BB8C-285824E51C4A v1.0 XactSrv service
Bindings:
ncalrpc:[LRPC-71a41a1021ac473a05]
Protocol: N/A
Provider: N/A
UUID : E38F5360-8572-473E-B696-1B46873BEEAB v1.0
Bindings:
ncalrpc:[OLE8319ADCD151B9098522E1C4C88FF]
ncalrpc:[LRPC-b12c52080acad2d963]
Protocol: N/A
Provider: N/A
UUID : 4C9DBF19-D39E-4BB9-90EE-8F7179B20283 v1.0
Bindings:
ncalrpc:[LRPC-b12c52080acad2d963]
Protocol: [MS-FASP]: Firewall and Advanced Security Protocol
Provider: FwRemoteSvr.dll
UUID : 6B5BDD1E-528C-422C-AF8C-A4079BE4FE48 v1.0 Remote Fw APIs
Bindings:
ncacn_ip_tcp:10.10.10.152[49667]
ncalrpc:[ipsec]
Protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol
Provider: samsrv.dll
UUID : 12345778-1234-ABCD-EF00-0123456789AC v1.0
Bindings:
ncacn_ip_tcp:10.10.10.152[49668]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[LSA_IDPEXT_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\NETMON[\pipe\lsass]
Protocol: [MS-SCMR]: Service Control Manager Remote Protocol
Provider: services.exe
UUID : 367ABB81-9844-35F1-AD32-98F038001003 v2.0
Bindings:
ncacn_ip_tcp:10.10.10.152[49669]
Protocol: N/A
Provider: N/A
UUID : F3F09FFD-FBCF-4291-944D-70AD6E0E73BB v1.0
Bindings:
ncalrpc:[LRPC-03ace2b12720ee9e7a]
Protocol: [MS-CMPO]: MSDTC Connection Manager:
Provider: msdtcprx.dll
UUID : 906B0CE0-C70B-1067-B317-00DD010662DA v1.0
Bindings:
ncalrpc:[LRPC-f5fbf0151d3622f9a9]
ncalrpc:[OLED6FF0C595C958605FD3E2947C995]
ncalrpc:[LRPC-a468c37b4395a36809]
ncalrpc:[LRPC-a468c37b4395a36809]
ncalrpc:[LRPC-a468c37b4395a36809]
[*] Received 196 endpoints.impacket-rpcdump found a total of 196 RPC endpoints
IOXIDResolver
┌──(kali㉿kali)-[~/archive/htb/labs/netmon]
└─$ python3 IOXIDResolver.py -t $IP
[*] Retrieving network interface of 10.10.10.152
address: netmon
address: 10.10.10.152
address: dead:beef::c81c:b924:b7e5:558
address: dead:beef::1aWhile IOXIDResolver.py found the hostname of the target system, it also discovered 2 unknown IPv6 addresses
IPv6
┌──(kali㉿kali)-[~/archive/htb/labs/netmon]
└─$ rustscan -a dead:beef::c81c:b924:b7e5:558 -b 20000
________________________________________
: https://discord.gg/GFrQsGy :
: https://github.com/RustScan/RustScan :
--------------------------------------
0day was here ♥
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
Open [dead:beef::c81c:b924:b7e5:558]:21
Open [dead:beef::c81c:b924:b7e5:558]:135
Open [dead:beef::c81c:b924:b7e5:558]:445
Open [dead:beef::c81c:b924:b7e5:558]:5985
┌──(kali㉿kali)-[~/archive/htb/labs/netmon]
└─$ rustscan -a dead:beef::1a -b 20000
________________________________________
: https://discord.gg/GFrQsGy :
: https://github.com/RustScan/RustScan :
--------------------------------------
Nmap? More like slowmap.🐢
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
Open [dead:beef::1a]:21
Open [dead:beef::1a]:135
Open [dead:beef::1a]:445
Open [dead:beef::1a]:5985None of these IPv6 addresses seem to host any additional service compared to the IPv4 counterpart