MSRPC

Nmap Omni a MSRPC service running on the target port 135

Null Session

┌──(kali㉿kali)-[~/archive/htb/labs/omni]
└─$ rpcclient $IP -N -U ''            
Cannot connect to server.  Error was NT_STATUS_IO_TIMEOUT

The MSRPC server doesn’t allow anonymous login

RPC Endpoint

┌──(kali㉿kali)-[~/archive/htb/labs/omni]
└─$ impacket-rpcdump $IP                                                         
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
 
[*] Retrieving endpoint list from 10.10.10.204
protocol: [MS-RSP]: Remote Shutdown Protocol 
provider: wininit.exe 
uuid    : D95AFE70-A6D5-4259-822E-2C84DA1DDB0D v1.0 
bindings: 
          ncacn_ip_tcp:10.10.10.204[49664]
          ncalrpc:[WindowsShutdown]
          ncacn_np:\\omni[\PIPE\InitShutdown]
          ncalrpc:[WMsgKRpc097890]
 
protocol: N/A 
provider: winlogon.exe 
uuid    : 76F226C3-EC14-4325-8A99-6A46348418AF v1.0 
bindings: 
          ncalrpc:[WindowsShutdown]
          ncacn_np:\\omni[\PIPE\InitShutdown]
          ncalrpc:[WMsgKRpc097890]
 
protocol: N/A 
provider: N/A 
uuid    : FC48CD89-98D6-4628-9839-86F7A3E4161A v1.0 
bindings: 
          ncalrpc:[OLE62232515D35C7C088BEF47533858]
          ncalrpc:[dabrpc]
          ncalrpc:[csebpub]
          ncalrpc:[LRPC-0cab7244b8db6e3c6a]
          ncalrpc:[LRPC-0d54327a6464bf4c88]
          ncalrpc:[LRPC-da16f72da26bde7652]
          ncalrpc:[LRPC-b3a90e50f22f490707]
          ncalrpc:[LRPC-88fbcef898dc1135a4]
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : D09BDEB5-6171-4A34-BFE2-06FA82652568 v1.0 
bindings: 
          ncalrpc:[csebpub]
          ncalrpc:[LRPC-0cab7244b8db6e3c6a]
          ncalrpc:[LRPC-0d54327a6464bf4c88]
          ncalrpc:[LRPC-da16f72da26bde7652]
          ncalrpc:[LRPC-b3a90e50f22f490707]
          ncalrpc:[LRPC-88fbcef898dc1135a4]
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
          ncalrpc:[LRPC-0d54327a6464bf4c88]
          ncalrpc:[LRPC-da16f72da26bde7652]
          ncalrpc:[LRPC-b3a90e50f22f490707]
          ncalrpc:[LRPC-88fbcef898dc1135a4]
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
          ncalrpc:[LRPC-da16f72da26bde7652]
          ncalrpc:[LRPC-b3a90e50f22f490707]
          ncalrpc:[LRPC-88fbcef898dc1135a4]
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
          ncalrpc:[LRPC-c945750087837ae3d5]
          ncalrpc:[a673c293-0306-494b-8bc6-e42fa412153e]
          ncalrpc:[LRPC-d93174502a8a11efec]
          ncacn_ip_tcp:10.10.10.204[49665]
          ncacn_np:\\omni[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[dhcpcsvc6]
          ncalrpc:[dhcpcsvc]
          ncalrpc:[LRPC-2ad8d8fe62cdd7905f]
          ncalrpc:[LRPC-577257354f8950b897]
          ncalrpc:[LRPC-182e2e1e100b5e751c]
          ncalrpc:[LRPC-9d3bab23efcf79775b]
          ncalrpc:[OLEF1AC9E453A4DEAC275165736BAD4]
          ncalrpc:[LRPC-0ad96604c0f70ae627]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
 
protocol: N/A 
provider: N/A 
uuid    : 697DCDA9-3BA9-4EB2-9247-E11F1901B0D2 v1.0 
bindings: 
          ncalrpc:[LRPC-0cab7244b8db6e3c6a]
          ncalrpc:[LRPC-0d54327a6464bf4c88]
          ncalrpc:[LRPC-da16f72da26bde7652]
          ncalrpc:[LRPC-b3a90e50f22f490707]
          ncalrpc:[LRPC-88fbcef898dc1135a4]
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 9B008953-F195-4BF9-BDE0-4471971E58ED v1.0 
bindings: 
          ncalrpc:[LRPC-0d54327a6464bf4c88]
          ncalrpc:[LRPC-da16f72da26bde7652]
          ncalrpc:[LRPC-b3a90e50f22f490707]
          ncalrpc:[LRPC-88fbcef898dc1135a4]
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : DD59071B-3215-4C59-8481-972EDADC0F6A v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 0D47017B-B33B-46AD-9E18-FE96456C5078 v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 95406F0B-B239-4318-91BB-CEA3A46FF0DC v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 4ED8ABCC-F1E2-438B-981F-BB0E8ABC010C v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 0FF1F646-13BB-400A-AB50-9A78F2B7A85A v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 6982A06E-5FE2-46B1-B39C-A2C545BFA069 v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 082A3471-31B6-422A-B931-A54401960C62 v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : FAE436B0-B864-4A87-9EDA-298547CD82F2 v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : E53D94CA-7464-4839-B044-09A2FB8B3AE5 v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 178D84BE-9291-4994-82C6-3F909ACA5A03 v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 4DACE966-A243-4450-AE3F-9B7BCB5315B8 v2.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 1832BCF6-CAB8-41D4-85D2-C9410764F75A v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : C521FACF-09A9-42C5-B155-72388595CBF0 v0.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 2C7FD9CE-E706-4B40-B412-953107EF9BB0 v0.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 88ABCBC3-34EA-76AE-8215-767520655A23 v0.0 
bindings: 
          ncalrpc:[LRPC-b3a90e50f22f490707]
          ncalrpc:[LRPC-88fbcef898dc1135a4]
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 76C217BC-C8B4-4201-A745-373AD9032B1A v1.0 
bindings: 
          ncalrpc:[LRPC-b3a90e50f22f490707]
          ncalrpc:[LRPC-88fbcef898dc1135a4]
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 55E6B932-1979-45D6-90C5-7F6270724112 v1.0 
bindings: 
          ncalrpc:[LRPC-b3a90e50f22f490707]
          ncalrpc:[LRPC-88fbcef898dc1135a4]
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 857FB1BE-084F-4FB5-B59C-4B2C4BE5F0CF v1.0 
bindings: 
          ncalrpc:[LRPC-88fbcef898dc1135a4]
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : B8CADBAF-E84B-46B9-84F2-6F71C03F9E55 v1.0 
bindings: 
          ncalrpc:[LRPC-88fbcef898dc1135a4]
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 20C40295-8DBA-48E6-AEBF-3E78EF3BB144 v1.0 
bindings: 
          ncalrpc:[LRPC-88fbcef898dc1135a4]
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 2513BCBE-6CD4-4348-855E-7EFB3C336DD3 v1.0 
bindings: 
          ncalrpc:[LRPC-88fbcef898dc1135a4]
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 0D3E2735-CEA0-4ECC-A9E2-41A2D81AED4E v1.0 
bindings: 
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : C605F9FB-F0A3-4E2A-A073-73560F8D9E3E v1.0 
bindings: 
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 1B37CA91-76B1-4F5E-A3C7-2ABFC61F2BB0 v1.0 
bindings: 
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 8BFC3BE1-6DEF-4E2D-AF74-7C47CD0ADE4A v1.0 
bindings: 
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 2D98A740-581D-41B9-AA0D-A88B9D5CE938 v1.0 
bindings: 
          ncalrpc:[LRPC-bbd8fa4f54c8ed8cf8]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 0361AE94-0316-4C6C-8AD8-C594375800E2 v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 5824833B-3C1A-4AD2-BDFD-C31D19E23ED2 v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : BDAA0970-413B-4A3E-9E5D-F6DC9D7E0760 v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 3B338D89-6CFA-44B8-847E-531531BC9992 v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 8782D3B9-EBBD-4644-A3D8-E8725381919B v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 085B0334-E454-4D91-9B8C-4134F9E793F3 v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : 4BEC6BB8-B5C2-4B6F-B2C1-5DA5CF92D0D9 v1.0 
bindings: 
          ncalrpc:[umpo]
 
protocol: N/A 
provider: N/A 
uuid    : DF4DF73A-C52D-4E3A-8003-8437FDF8302A v0.0 WM_WindowManagerRPC\Server
bindings: 
          ncalrpc:[LRPC-aed3d8c347eee90970]
 
protocol: N/A 
provider: N/A 
uuid    : 6770612B-B256-4B6E-891B-2FF9936755A1 v1.0 
bindings: 
          ncalrpc:[SmsRouterSvcRpc]
 
protocol: N/A 
provider: N/A 
uuid    : ACD792E4-5239-48B6-8BAF-7D0A79A64AC0 v0.0 
bindings: 
          ncalrpc:[SmsRouterSvcRpc]
 
protocol: N/A 
provider: N/A 
uuid    : A500D4C6-0DD1-4543-BC0C-D5F93486EAF8 v1.0 
bindings: 
          ncalrpc:[LRPC-fe40dae48aa1fe485e]
          ncalrpc:[LRPC-c945750087837ae3d5]
          ncalrpc:[a673c293-0306-494b-8bc6-e42fa412153e]
          ncalrpc:[LRPC-d93174502a8a11efec]
          ncacn_ip_tcp:10.10.10.204[49665]
          ncacn_np:\\omni[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[dhcpcsvc6]
          ncalrpc:[dhcpcsvc]
          ncalrpc:[LRPC-2ad8d8fe62cdd7905f]
 
protocol: N/A 
provider: N/A 
uuid    : 3473DD4D-2E88-4006-9CBA-22570909DD10 v5.1 WinHttp Auto-Proxy Service
bindings: 
          ncalrpc:[a673c293-0306-494b-8bc6-e42fa412153e]
          ncalrpc:[LRPC-d93174502a8a11efec]
          ncacn_ip_tcp:10.10.10.204[49665]
          ncacn_np:\\omni[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[dhcpcsvc6]
          ncalrpc:[dhcpcsvc]
          ncalrpc:[LRPC-2ad8d8fe62cdd7905f]
 
protocol: [MS-EVEN6]: EventLog Remoting Protocol 
provider: wevtsvc.dll 
uuid    : F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C v1.0 Event log TCPIP
bindings: 
          ncacn_ip_tcp:10.10.10.204[49665]
          ncacn_np:\\omni[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[dhcpcsvc6]
          ncalrpc:[dhcpcsvc]
          ncalrpc:[LRPC-2ad8d8fe62cdd7905f]
 
protocol: N/A 
provider: dhcpcsvc6.dll 
uuid    : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D6 v1.0 DHCPv6 Client LRPC Endpoint
bindings: 
          ncalrpc:[dhcpcsvc6]
          ncalrpc:[dhcpcsvc]
          ncalrpc:[LRPC-2ad8d8fe62cdd7905f]
 
protocol: N/A 
provider: dhcpcsvc.dll 
uuid    : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D5 v1.0 DHCP Client LRPC Endpoint
bindings: 
          ncalrpc:[dhcpcsvc]
          ncalrpc:[LRPC-2ad8d8fe62cdd7905f]
 
protocol: N/A 
provider: nrpsrv.dll 
uuid    : 30ADC50C-5CBC-46CE-9A0E-91914789E23C v1.0 NRP server endpoint
bindings: 
          ncalrpc:[LRPC-2ad8d8fe62cdd7905f]
 
protocol: N/A 
provider: bthserv.dll 
uuid    : 2ACB9D68-B434-4B3E-B966-E06B4B3A84CB v1.0 
bindings: 
          ncalrpc:[LRPC-6497db4beb47940e1a]
          ncalrpc:[LRPC-577257354f8950b897]
          ncalrpc:[LRPC-182e2e1e100b5e751c]
          ncalrpc:[LRPC-9d3bab23efcf79775b]
          ncalrpc:[OLEF1AC9E453A4DEAC275165736BAD4]
          ncalrpc:[LRPC-0ad96604c0f70ae627]
 
protocol: N/A 
provider: N/A 
uuid    : 5DEA026D-F999-40B1-A234-2164FD086783 v1.0 
bindings: 
          ncalrpc:[LRPC-182e2e1e100b5e751c]
          ncalrpc:[LRPC-9d3bab23efcf79775b]
          ncalrpc:[OLEF1AC9E453A4DEAC275165736BAD4]
          ncalrpc:[LRPC-0ad96604c0f70ae627]
 
protocol: N/A 
provider: N/A 
uuid    : 0A533B58-0ED9-4085-B6E8-95795E147972 v1.0 
bindings: 
          ncalrpc:[LRPC-9d3bab23efcf79775b]
          ncalrpc:[OLEF1AC9E453A4DEAC275165736BAD4]
          ncalrpc:[LRPC-0ad96604c0f70ae627]
 
protocol: N/A 
provider: nsisvc.dll 
uuid    : 7EA70BCF-48AF-4F6A-8968-6A440754D5FA v1.0 NSI server endpoint
bindings: 
          ncalrpc:[LRPC-0ad96604c0f70ae627]
 
protocol: N/A 
provider: sysmain.dll 
uuid    : B58AA02E-2884-4E97-8176-4EE06D794184 v1.0 
bindings: 
          ncalrpc:[LRPC-2ba9ba2af2efb7c1c2]
          ncalrpc:[LRPC-1843d28c7f90e72d72]
          ncalrpc:[LRPC-529a49e861c70e151b]
          ncalrpc:[LRPC-903d13796391562f99]
          ncalrpc:[LRPC-6453cfe544caf31541]
          ncalrpc:[OLEB486F33A8AEA150D17D82C6239B7]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
 
protocol: N/A 
provider: N/A 
uuid    : 266F33B4-C7C1-4BD1-8F52-DDB8F2214EB0 v1.0 Wlan Service LowPriv
bindings: 
          ncalrpc:[LRPC-1843d28c7f90e72d72]
          ncalrpc:[LRPC-529a49e861c70e151b]
          ncalrpc:[LRPC-903d13796391562f99]
          ncalrpc:[LRPC-6453cfe544caf31541]
          ncalrpc:[OLEB486F33A8AEA150D17D82C6239B7]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
 
protocol: N/A 
provider: wlansvc.dll 
uuid    : 266F33B4-C7C1-4BD1-8F52-DDB8F2214EA9 v1.0 Wlan Service
bindings: 
          ncalrpc:[LRPC-1843d28c7f90e72d72]
          ncalrpc:[LRPC-529a49e861c70e151b]
          ncalrpc:[LRPC-903d13796391562f99]
          ncalrpc:[LRPC-6453cfe544caf31541]
          ncalrpc:[OLEB486F33A8AEA150D17D82C6239B7]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
 
protocol: N/A 
provider: sysntfy.dll 
uuid    : C9AC6DB5-82B7-4E55-AE8A-E464ED7B4277 v1.0 Impl friendly name
bindings: 
          ncalrpc:[LRPC-529a49e861c70e151b]
          ncalrpc:[LRPC-903d13796391562f99]
          ncalrpc:[LRPC-6453cfe544caf31541]
          ncalrpc:[OLEB486F33A8AEA150D17D82C6239B7]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
          ncalrpc:[IUserProfile2]
          ncalrpc:[OLE17412AED5B44BA2D78143B771A50]
 
protocol: N/A 
provider: wlansvc.dll 
uuid    : 25952C5D-7976-4AA1-A3CB-C35F7AE79D1B v1.1 Wireless Diagnostics
bindings: 
          ncalrpc:[LRPC-529a49e861c70e151b]
          ncalrpc:[LRPC-903d13796391562f99]
          ncalrpc:[LRPC-6453cfe544caf31541]
          ncalrpc:[OLEB486F33A8AEA150D17D82C6239B7]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
 
protocol: N/A 
provider: N/A 
uuid    : DE2DAF3B-5C16-4613-B204-D810EE629D9E v1.0 
bindings: 
          ncalrpc:[LRPC-529a49e861c70e151b]
          ncalrpc:[LRPC-903d13796391562f99]
          ncalrpc:[LRPC-6453cfe544caf31541]
          ncalrpc:[OLEB486F33A8AEA150D17D82C6239B7]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
 
protocol: N/A 
provider: N/A 
uuid    : 9C56D792-0591-4431-8D1F-681BFD80E4C0 v1.0 Wwan Service Second
bindings: 
          ncalrpc:[LRPC-903d13796391562f99]
          ncalrpc:[LRPC-6453cfe544caf31541]
          ncalrpc:[OLEB486F33A8AEA150D17D82C6239B7]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
 
protocol: N/A 
provider: N/A 
uuid    : B4CB7611-AD0B-4C2D-B35F-FFE45785C709 v1.0 Wwan Service
bindings: 
          ncalrpc:[LRPC-903d13796391562f99]
          ncalrpc:[LRPC-6453cfe544caf31541]
          ncalrpc:[OLEB486F33A8AEA150D17D82C6239B7]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
 
protocol: N/A 
provider: N/A 
uuid    : E40F7B57-7A25-4CD3-A135-7F7D3DF9D16B v1.0 Network Connection Broker server endpoint
bindings: 
          ncalrpc:[LRPC-903d13796391562f99]
          ncalrpc:[LRPC-6453cfe544caf31541]
          ncalrpc:[OLEB486F33A8AEA150D17D82C6239B7]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
 
protocol: N/A 
provider: N/A 
uuid    : 880FD55E-43B9-11E0-B1A8-CF4EDFD72085 v1.0 KAPI Service endpoint
bindings: 
          ncalrpc:[LRPC-903d13796391562f99]
          ncalrpc:[LRPC-6453cfe544caf31541]
          ncalrpc:[OLEB486F33A8AEA150D17D82C6239B7]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
 
protocol: N/A 
provider: N/A 
uuid    : 97BE9507-17DA-4999-87D7-66C0B2D83CC7 v1.0 
bindings: 
          ncalrpc:[LRPC-6453cfe544caf31541]
          ncalrpc:[OLEB486F33A8AEA150D17D82C6239B7]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
 
protocol: N/A 
provider: N/A 
uuid    : DB2CE634-191D-42AF-A28C-16BE97924CA7 v1.0 
bindings: 
          ncalrpc:[LRPC-6453cfe544caf31541]
          ncalrpc:[OLEB486F33A8AEA150D17D82C6239B7]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
 
protocol: N/A 
provider: N/A 
uuid    : 5222821F-D5E2-4885-84F1-5F6185A0EC41 v1.0 Network Connection Broker server endpoint for NCB Reset module
bindings: 
          ncalrpc:[LRPC-6453cfe544caf31541]
          ncalrpc:[OLEB486F33A8AEA150D17D82C6239B7]
          ncalrpc:[LRPC-80f4d2b5253231ac39]
 
protocol: N/A 
provider: N/A 
uuid    : 945693C4-3648-4966-B2AA-37D66E24495F v0.0 
bindings: 
          ncalrpc:[LRPC-675c67a28ff89859c3]
 
protocol: N/A 
provider: N/A 
uuid    : 795B6BF9-97B6-4F89-BD8D-2F42BBBE996E v0.0 
bindings: 
          ncalrpc:[LRPC-675c67a28ff89859c3]
 
protocol: N/A 
provider: N/A 
uuid    : 572E35B4-1344-4565-96A1-F5DF3BFA89BB v1.0 LiveIdSvcNotify RPC Interface
bindings: 
          ncalrpc:[liveidsvcnotify]
 
protocol: N/A 
provider: N/A 
uuid    : FAF2447B-B348-4FEB-8DBE-BEEE5B7F7778 v1.0 OnlineProviderCert RPC Interface
bindings: 
          ncalrpc:[LRPC-cf0ebeb504d0d5b55d]
 
protocol: N/A 
provider: N/A 
uuid    : CC105610-DA03-467E-BC73-5B9E2937458D v1.0 LiveIdSvc RPC Interface
bindings: 
          ncalrpc:[LRPC-cf0ebeb504d0d5b55d]
 
protocol: N/A 
provider: N/A 
uuid    : 0D3C7F20-1C8D-4654-A1B3-51563B298BDA v1.0 UserMgrCli
bindings: 
          ncalrpc:[LRPC-6d39c8a637fd2d1fa6]
          ncacn_np:\\omni[\PIPE\srvsvc]
          ncalrpc:[TeredoControl]
          ncalrpc:[TeredoDiagnostics]
          ncalrpc:[LRPC-535c29f57a28cc3e6d]
          ncalrpc:[ubpmtaskhostchannel]
          ncalrpc:[DeviceSetupManager]
          ncalrpc:[IUserProfile2]
          ncalrpc:[OLE17412AED5B44BA2D78143B771A50]
 
protocol: N/A 
provider: N/A 
uuid    : B18FBAB6-56F8-4702-84E0-41053293A869 v1.0 UserMgrCli
bindings: 
          ncalrpc:[LRPC-6d39c8a637fd2d1fa6]
          ncacn_np:\\omni[\PIPE\srvsvc]
          ncalrpc:[TeredoControl]
          ncalrpc:[TeredoDiagnostics]
          ncalrpc:[LRPC-535c29f57a28cc3e6d]
          ncalrpc:[ubpmtaskhostchannel]
          ncalrpc:[DeviceSetupManager]
          ncalrpc:[IUserProfile2]
          ncalrpc:[OLE17412AED5B44BA2D78143B771A50]
 
protocol: N/A 
provider: N/A 
uuid    : 1A0D010F-1C33-432C-B0F5-8CF4E8053099 v1.0 IdSegSrv service
bindings: 
          ncalrpc:[TeredoControl]
          ncalrpc:[TeredoDiagnostics]
          ncalrpc:[LRPC-535c29f57a28cc3e6d]
          ncalrpc:[ubpmtaskhostchannel]
          ncalrpc:[DeviceSetupManager]
          ncalrpc:[IUserProfile2]
          ncalrpc:[OLE17412AED5B44BA2D78143B771A50]
 
protocol: N/A 
provider: srvsvc.dll 
uuid    : 98716D03-89AC-44C7-BB8C-285824E51C4A v1.0 XactSrv service
bindings: 
          ncalrpc:[TeredoControl]
          ncalrpc:[TeredoDiagnostics]
          ncalrpc:[LRPC-535c29f57a28cc3e6d]
          ncalrpc:[ubpmtaskhostchannel]
          ncalrpc:[DeviceSetupManager]
          ncalrpc:[IUserProfile2]
          ncalrpc:[OLE17412AED5B44BA2D78143B771A50]
 
protocol: N/A 
provider: iphlpsvc.dll 
uuid    : 552D076A-CB29-4E44-8B6A-D15E59E2C0AF v1.0 IP Transition Configuration endpoint
bindings: 
          ncalrpc:[LRPC-535c29f57a28cc3e6d]
          ncalrpc:[ubpmtaskhostchannel]
          ncalrpc:[DeviceSetupManager]
          ncalrpc:[IUserProfile2]
          ncalrpc:[OLE17412AED5B44BA2D78143B771A50]
 
protocol: N/A 
provider: N/A 
uuid    : 3A9EF155-691D-4449-8D05-09AD57031823 v1.0 
bindings: 
          ncalrpc:[LRPC-535c29f57a28cc3e6d]
          ncalrpc:[ubpmtaskhostchannel]
          ncalrpc:[DeviceSetupManager]
          ncalrpc:[IUserProfile2]
          ncalrpc:[OLE17412AED5B44BA2D78143B771A50]
 
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol 
provider: schedsvc.dll 
uuid    : 86D35949-83C9-4044-B424-DB363231FD0C v1.0 
bindings: 
          ncalrpc:[LRPC-535c29f57a28cc3e6d]
          ncalrpc:[ubpmtaskhostchannel]
          ncalrpc:[DeviceSetupManager]
          ncalrpc:[IUserProfile2]
          ncalrpc:[OLE17412AED5B44BA2D78143B771A50]
 
protocol: N/A 
provider: N/A 
uuid    : 33D84484-3626-47EE-8C6F-E7E98B113BE1 v2.0 
bindings: 
          ncalrpc:[LRPC-535c29f57a28cc3e6d]
          ncalrpc:[ubpmtaskhostchannel]
          ncalrpc:[DeviceSetupManager]
          ncalrpc:[IUserProfile2]
          ncalrpc:[OLE17412AED5B44BA2D78143B771A50]
 
protocol: N/A 
provider: schedsvc.dll 
uuid    : 0A74EF1C-41A4-4E06-83AE-DC74FB1CDD53 v1.0 
bindings: 
          ncalrpc:[DeviceSetupManager]
          ncalrpc:[IUserProfile2]
          ncalrpc:[OLE17412AED5B44BA2D78143B771A50]
 
protocol: N/A 
provider: N/A 
uuid    : 7F1343FE-50A9-4927-A778-0C5859517BAC v1.0 DfsDs service
bindings: 
          ncacn_np:\\omni[\PIPE\wkssvc]
          ncalrpc:[DNSResolver]
          ncalrpc:[nlaapi]
          ncalrpc:[nlaplg]
 
protocol: N/A 
provider: N/A 
uuid    : EB081A0D-10EE-478A-A1DD-50995283E7A8 v3.0 Witness Client Test Interface
bindings: 
          ncalrpc:[DNSResolver]
          ncalrpc:[nlaapi]
          ncalrpc:[nlaplg]
 
protocol: N/A 
provider: N/A 
uuid    : F2C9B409-C1C9-4100-8639-D8AB1486694A v1.0 Witness Client Upcall Server
bindings: 
          ncalrpc:[DNSResolver]
          ncalrpc:[nlaapi]
          ncalrpc:[nlaplg]
 
protocol: N/A 
provider: N/A 
uuid    : C2D1B5DD-FA81-4460-9DD6-E7658B85454B v1.0 
bindings: 
          ncalrpc:[LRPC-eae41befd19c318fea]
 
protocol: N/A 
provider: N/A 
uuid    : F44E62AF-DAB1-44C2-8013-049A9DE417D6 v1.0 
bindings: 
          ncalrpc:[LRPC-eae41befd19c318fea]
 
protocol: N/A 
provider: N/A 
uuid    : 7AEB6705-3AE6-471A-882D-F39C109EDC12 v1.0 
bindings: 
          ncalrpc:[LRPC-eae41befd19c318fea]
 
protocol: N/A 
provider: N/A 
uuid    : E7F76134-9EF5-4949-A2D6-3368CC0988F3 v1.0 
bindings: 
          ncalrpc:[LRPC-eae41befd19c318fea]
 
protocol: N/A 
provider: N/A 
uuid    : B37F900A-EAE4-4304-A2AB-12BB668C0188 v1.0 
bindings: 
          ncalrpc:[LRPC-eae41befd19c318fea]
 
protocol: N/A 
provider: N/A 
uuid    : ABFB6CA3-0C5E-4734-9285-0AEE72FE8D1C v1.0 
bindings: 
          ncalrpc:[LRPC-eae41befd19c318fea]
 
protocol: N/A 
provider: MPSSVC.dll 
uuid    : 2FB92682-6599-42DC-AE13-BD2CA89BD11C v1.0 Fw APIs
bindings: 
          ncalrpc:[LRPC-c8dd0065f07a51a82d]
          ncalrpc:[LRPC-5a504599ce282baffb]
          ncalrpc:[LRPC-6afa06f5b40a850741]
          ncalrpc:[LRPC-dbc114c2bcf0069fcd]
 
protocol: N/A 
provider: N/A 
uuid    : F47433C3-3E9D-4157-AAD4-83AA1F5C2D4C v1.0 Fw APIs
bindings: 
          ncalrpc:[LRPC-5a504599ce282baffb]
          ncalrpc:[LRPC-6afa06f5b40a850741]
          ncalrpc:[LRPC-dbc114c2bcf0069fcd]
 
protocol: N/A 
provider: MPSSVC.dll 
uuid    : 7F9D11BF-7FB9-436B-A812-B2D50C5D4C03 v1.0 Fw APIs
bindings: 
          ncalrpc:[LRPC-6afa06f5b40a850741]
          ncalrpc:[LRPC-dbc114c2bcf0069fcd]
 
protocol: N/A 
provider: BFE.DLL 
uuid    : DD490425-5325-4565-B774-7E27D6C09C24 v1.0 Base Firewall Engine API
bindings: 
          ncalrpc:[LRPC-dbc114c2bcf0069fcd]
 
protocol: [MS-SCMR]: Service Control Manager Remote Protocol 
provider: services.exe 
uuid    : 367ABB81-9844-35F1-AD32-98F038001003 v2.0 
bindings: 
          ncacn_ip_tcp:10.10.10.204[49666]
 
protocol: N/A 
provider: N/A 
uuid    : 98CD761E-E77D-41C8-A3C0-0FB756D90EC2 v1.0 
bindings: 
          ncalrpc:[LRPC-510fad1ec965167388]
 
protocol: N/A 
provider: N/A 
uuid    : D22895EF-AFF4-42C5-A5B2-B14466D34AB4 v1.0 
bindings: 
          ncalrpc:[LRPC-510fad1ec965167388]
 
protocol: N/A 
provider: N/A 
uuid    : E38F5360-8572-473E-B696-1B46873BEEAB v1.0 
bindings: 
          ncalrpc:[LRPC-510fad1ec965167388]
 
protocol: N/A 
provider: N/A 
uuid    : 95095EC8-32EA-4EB0-A3E2-041F97B36168 v1.0 
bindings: 
          ncalrpc:[LRPC-510fad1ec965167388]
 
protocol: N/A 
provider: N/A 
uuid    : FD8BE72B-A9CD-4B2C-A9CA-4DED242FBE4D v1.0 
bindings: 
          ncalrpc:[LRPC-510fad1ec965167388]
 
protocol: N/A 
provider: N/A 
uuid    : 4C9DBF19-D39E-4BB9-90EE-8F7179B20283 v1.0 
bindings: 
          ncalrpc:[LRPC-510fad1ec965167388]
 
protocol: N/A 
provider: N/A 
uuid    : C27F3C08-92BA-478C-B446-B419C4CEF0E2 v1.0 
bindings: 
          ncalrpc:[LRPC-139410587fa65e8679]
 
protocol: N/A 
provider: N/A 
uuid    : B1EF227E-DFA5-421E-82BB-67A6A129C496 v0.0 
bindings: 
          ncalrpc:[LRPC-4ab76e0ca5f804a4e1]
          ncalrpc:[OLEB7C545E14734381B034AEF004235]
 
protocol: N/A 
provider: N/A 
uuid    : 0FC77B1A-95D8-4A2E-A0C0-CFF54237462B v0.0 
bindings: 
          ncalrpc:[LRPC-4ab76e0ca5f804a4e1]
          ncalrpc:[OLEB7C545E14734381B034AEF004235]
 
protocol: N/A 
provider: N/A 
uuid    : 8EC21E98-B5CE-4916-A3D6-449FA428A007 v0.0 
bindings: 
          ncalrpc:[LRPC-4ab76e0ca5f804a4e1]
          ncalrpc:[OLEB7C545E14734381B034AEF004235]
 
protocol: N/A 
provider: N/A 
uuid    : 51A227AE-825B-41F2-B4A9-1AC9557A1018 v1.0 Ngc Pop Key Service
bindings: 
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[LSA_IDPEXT_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\omni[\pipe\lsass]
 
protocol: N/A 
provider: N/A 
uuid    : 8FB74744-B2FF-4C00-BE0D-9EF9A191FE1B v1.0 Ngc Pop Key Service
bindings: 
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[LSA_IDPEXT_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\omni[\pipe\lsass]
 
protocol: N/A 
provider: N/A 
uuid    : B25A52BF-E5DD-4F4A-AEA6-8CA7272A0E86 v2.0 KeyIso
bindings: 
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[LSA_IDPEXT_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\omni[\pipe\lsass]
 
protocol: N/A 
provider: N/A 
uuid    : 64D1D045-F675-460B-8A94-570246B36DAB v1.0 CLIPSVC Default RPC Interface
bindings: 
          ncalrpc:[ClipServiceTransportEndpoint-00001]
 
protocol: N/A 
provider: N/A 
uuid    : FF9FD3C4-742E-45E0-91DD-2F5BC632A1DF v1.0 appxsvc
bindings: 
          ncalrpc:[LRPC-355f78fd405cf4d9f9]
 
protocol: N/A 
provider: N/A 
uuid    : AE2DC901-312D-41DF-8B79-E835E63DB874 v1.0 appxsvc
bindings: 
          ncalrpc:[LRPC-355f78fd405cf4d9f9]
 
protocol: N/A 
provider: N/A 
uuid    : E3DC38E9-B3AF-4ED1-9CC8-938DE5F16E14 v1.0 
bindings: 
          ncalrpc:[LRPC-c75777e9db0704c90c]
 
[*] Received 385 endpoints.

impacket-rpcdump enumerated a total of 385 RPC endpoints

IOXIDResolver

┌──(kali㉿kali)-[~/archive/htb/labs/omni]
└─$ python3 IOXIDResolver.py -t $IP                 
[*] Retrieving network interface of 10.10.10.204
Address: omni
Address: 10.10.10.204
Address: dead:beef::f178:17b1:199:4ce4
Address: dead:beef::f443:5df:b248:953c
Address: dead:beef::a8

IOXIDResolver.py discovered the hostname of the target stystem. It also enumerated additional 3 IPv6 addresses

IPv6

┌──(kali㉿kali)-[~/archive/htb/labs/omni]
└─$ rustscan -a dead:beef::f178:17b1:199:4ce4 -b 10000
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
open [dead:beef::f178:17b1:199:4ce4]:135
open [dead:beef::f178:17b1:199:4ce4]:5985
open [dead:beef::f178:17b1:199:4ce4]:8080
 
┌──(kali㉿kali)-[~/archive/htb/labs/omni]
└─$ rustscan -a dead:beef::f443:5df:b248:953c -b 10000
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
open [dead:beef::f443:5df:b248:953c]:135
open [dead:beef::f443:5df:b248:953c]:5985
open [dead:beef::f443:5df:b248:953c]:8080
 
┌──(kali㉿kali)-[~/archive/htb/labs/omni]
└─$ rustscan -a dead:beef::a8 -b 10000
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
open [dead:beef::a8]:135
open [dead:beef::a8]:5985
open [dead:beef::a8]:8080

Those IPv6 addresses are all identical in terms of services provided, but they don’t have those 3 unusual ports open like the IPv4 address does

InfoSec LAB

Explorer

Omni_MSRPC

MSRPC

Null Session

RPC Endpoint

IOXIDResolver

IPv6

Interactive Graph View

Table of Contents

Backlinks