MSRPC
Nmap discovered a MSRPC service on the target port 135 and 593
The running services are Microsoft Windows RPC and Microsoft Windows RPC over HTTP 1.0
┌──(kali㉿kali)-[~/archive/htb/labs/resolute]
└─$ rpcclient $IP -N -U ''
rpcclient $> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[DefaultAccount] rid:[0x1f7]
user:[ryan] rid:[0x451]
user:[marko] rid:[0x457]
user:[sunita] rid:[0x19c9]
user:[abigail] rid:[0x19ca]
user:[marcus] rid:[0x19cb]
user:[sally] rid:[0x19cc]
user:[fred] rid:[0x19cd]
user:[angela] rid:[0x19ce]
user:[felicia] rid:[0x19cf]
user:[gustavo] rid:[0x19d0]
user:[ulf] rid:[0x19d1]
user:[stevie] rid:[0x19d2]
user:[claire] rid:[0x19d3]
user:[paulo] rid:[0x19d4]
user:[steve] rid:[0x19d5]
user:[annette] rid:[0x19d6]
user:[annika] rid:[0x19d7]
user:[per] rid:[0x19d8]
user:[claude] rid:[0x19d9]
user:[melanie] rid:[0x2775]
user:[zach] rid:[0x2776]
user:[simon] rid:[0x2777]
user:[naoki] rid:[0x2778]
rpcclient $> lsaenumsid
result was NT_STATUS_ACCESS_DENIED
rpcclient $> enumprinters
do_cmd: Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED
The target MSRPC server allows anonymous access Additionally, there is a limited access control, allowing me to access the information about the domain users There are 27 domain users.
within the rpcclient session, there are a few commands to enumerate the target domain. some of them are enumprivs, srvinfo, netshareenum, querydominfo, and more
CLEARTEXT password
While I was going through some of those commands above, I found something interesting
rpcclient $> queryuser marko
User Name : marko
Full Name : Marko Novak
Home Drive :
Dir Drive :
Profile Path:
Logon Script:
Description : Account created. Password set to Welcome123!
Workstations:
Comment :
Remote Dial :
Logon Time : Thu, 01 Jan 1970 01:00:00 CET
Logoff Time : Thu, 01 Jan 1970 01:00:00 CET
Kickoff Time : Thu, 14 Sep 30828 04:48:05 CEST
Password last set Time : Fri, 27 Sep 2019 15:17:15 CEST
Password can change Time : Sat, 28 Sep 2019 15:17:15 CEST
Password must change Time: Thu, 14 Sep 30828 04:48:05 CEST
unknown_2[0..31]...
user_rid : 0x457
group_rid: 0x201
acb_info : 0x00000210
fields_present: 0x00ffffff
logon_divs: 168
bad_password_count: 0x00000001
logon_count: 0x00000000
padding1[0..7]...
logon_hrs[0..21]...The Description attribute for the marko user has a CLEARTEXT password; Welcome123!
The credential require validation
RPC Endpoints
┌──(kali㉿kali)-[~/archive/htb/labs/resolute]
└─$ impacket-rpcdump $IP
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Retrieving endpoint list from 10.10.10.169
protocol: [MS-RSP]: Remote Shutdown Protocol
provider: wininit.exe
uuid : D95AFE70-A6D5-4259-822E-2C84DA1DDB0D v1.0
bindings:
ncacn_ip_tcp:10.10.10.169[49664]
ncalrpc:[WindowsShutdown]
ncacn_np:\\RESOLUTE[\PIPE\InitShutdown]
ncalrpc:[WMsgKRpc07DD80]
protocol: N/A
provider: winlogon.exe
uuid : 76F226C3-EC14-4325-8A99-6A46348418AF v1.0
bindings:
ncalrpc:[WindowsShutdown]
ncacn_np:\\RESOLUTE[\PIPE\InitShutdown]
ncalrpc:[WMsgKRpc07DD80]
ncalrpc:[WMsgKRpc080221]
protocol: N/A
provider: N/A
uuid : D09BDEB5-6171-4A34-BFE2-06FA82652568 v1.0
bindings:
ncalrpc:[csebpub]
ncalrpc:[LRPC-c6005c6cfe4a806ae6]
ncalrpc:[LRPC-5f349dea2063ed2709]
ncacn_np:\\RESOLUTE[\pipe\LSM_API_service]
ncalrpc:[LSMApi]
ncalrpc:[LRPC-263d44932b0f40491c]
ncalrpc:[actkernel]
ncalrpc:[umpo]
ncalrpc:[LRPC-5f349dea2063ed2709]
ncacn_np:\\RESOLUTE[\pipe\LSM_API_service]
ncalrpc:[LSMApi]
ncalrpc:[LRPC-263d44932b0f40491c]
ncalrpc:[actkernel]
ncalrpc:[umpo]
ncalrpc:[LRPC-bdce91e2f459c7ddff]
ncalrpc:[dhcpcsvc6]
ncalrpc:[dhcpcsvc]
ncacn_ip_tcp:10.10.10.169[49665]
ncacn_np:\\RESOLUTE[\pipe\eventlog]
ncalrpc:[eventlog]
protocol: N/A
provider: N/A
uuid : 697DCDA9-3BA9-4EB2-9247-E11F1901B0D2 v1.0
bindings:
ncalrpc:[LRPC-c6005c6cfe4a806ae6]
ncalrpc:[LRPC-5f349dea2063ed2709]
ncacn_np:\\RESOLUTE[\pipe\LSM_API_service]
ncalrpc:[LSMApi]
ncalrpc:[LRPC-263d44932b0f40491c]
ncalrpc:[actkernel]
ncalrpc:[umpo]
protocol: N/A
provider: sysntfy.dll
uuid : C9AC6DB5-82B7-4E55-AE8A-E464ED7B4277 v1.0 Impl friendly name
bindings:
ncalrpc:[LRPC-263d44932b0f40491c]
ncalrpc:[actkernel]
ncalrpc:[umpo]
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
ncalrpc:[IUserProfile2]
ncacn_ip_tcp:10.10.10.169[49678]
ncalrpc:[OLE73F3DDEB64592CCC19B1695B94A5]
ncacn_ip_tcp:10.10.10.169[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\RESOLUTE[\pipe\lsass]
protocol: N/A
provider: N/A
uuid : 3473DD4D-2E88-4006-9CBA-22570909DD10 v5.1 WinHttp Auto-Proxy Service
bindings:
ncalrpc:[OLE3744382F4235590373D144CE7772]
ncalrpc:[LRPC-3adc118be9c187374f]
protocol: N/A
provider: nsisvc.dll
uuid : 7EA70BCF-48AF-4F6A-8968-6A440754D5FA v1.0 NSI server endpoint
bindings:
ncalrpc:[LRPC-3adc118be9c187374f]
protocol: N/A
provider: nrpsrv.dll
uuid : 30ADC50C-5CBC-46CE-9A0E-91914789E23C v1.0 NRP server endpoint
bindings:
ncalrpc:[LRPC-6b5ec50805020bd8ad]
ncalrpc:[LRPC-14f905e42379485dd1]
ncalrpc:[LRPC-bdce91e2f459c7ddff]
ncalrpc:[dhcpcsvc6]
ncalrpc:[dhcpcsvc]
ncacn_ip_tcp:10.10.10.169[49665]
ncacn_np:\\RESOLUTE[\pipe\eventlog]
ncalrpc:[eventlog]
protocol: N/A
provider: N/A
uuid : A500D4C6-0DD1-4543-BC0C-D5F93486EAF8 v1.0
bindings:
ncalrpc:[LRPC-14f905e42379485dd1]
ncalrpc:[LRPC-bdce91e2f459c7ddff]
ncalrpc:[dhcpcsvc6]
ncalrpc:[dhcpcsvc]
ncacn_ip_tcp:10.10.10.169[49665]
ncacn_np:\\RESOLUTE[\pipe\eventlog]
ncalrpc:[eventlog]
protocol: N/A
provider: dhcpcsvc6.dll
uuid : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D6 v1.0 DHCPv6 Client LRPC Endpoint
bindings:
ncalrpc:[dhcpcsvc6]
ncalrpc:[dhcpcsvc]
ncacn_ip_tcp:10.10.10.169[49665]
ncacn_np:\\RESOLUTE[\pipe\eventlog]
ncalrpc:[eventlog]
protocol: N/A
provider: dhcpcsvc.dll
uuid : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D5 v1.0 DHCP Client LRPC Endpoint
bindings:
ncalrpc:[dhcpcsvc]
ncacn_ip_tcp:10.10.10.169[49665]
ncacn_np:\\RESOLUTE[\pipe\eventlog]
ncalrpc:[eventlog]
protocol: [MS-EVEN6]: EventLog Remoting Protocol
provider: wevtsvc.dll
uuid : F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C v1.0 Event log TCPIP
bindings:
ncacn_ip_tcp:10.10.10.169[49665]
ncacn_np:\\RESOLUTE[\pipe\eventlog]
ncalrpc:[eventlog]
protocol: N/A
provider: N/A
uuid : C49A5A70-8A7F-4E70-BA16-1E8F1F193EF1 v1.0 Adh APIs
bindings:
ncalrpc:[LRPC-9eacdcee2e8e2dc6a2]
ncacn_ip_tcp:10.10.10.169[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\RESOLUTE[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
protocol: N/A
provider: IKEEXT.DLL
uuid : A398E520-D59A-4BDD-AA7A-3C1E0303A511 v1.0 IKE/Authip API
bindings:
ncalrpc:[LRPC-9eacdcee2e8e2dc6a2]
ncacn_ip_tcp:10.10.10.169[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\RESOLUTE[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
protocol: N/A
provider: N/A
uuid : C36BE077-E14B-4FE9-8ABC-E856EF4F048B v1.0 Proxy Manager client server endpoint
bindings:
ncalrpc:[LRPC-9eacdcee2e8e2dc6a2]
ncacn_ip_tcp:10.10.10.169[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\RESOLUTE[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
protocol: N/A
provider: N/A
uuid : 2E6035B2-E8F1-41A7-A044-656B439C4C34 v1.0 Proxy Manager provider server endpoint
bindings:
ncalrpc:[LRPC-9eacdcee2e8e2dc6a2]
ncacn_ip_tcp:10.10.10.169[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\RESOLUTE[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
protocol: N/A
provider: iphlpsvc.dll
uuid : 552D076A-CB29-4E44-8B6A-D15E59E2C0AF v1.0 IP Transition Configuration endpoint
bindings:
ncalrpc:[LRPC-9eacdcee2e8e2dc6a2]
ncacn_ip_tcp:10.10.10.169[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\RESOLUTE[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
protocol: N/A
provider: N/A
uuid : 0D3C7F20-1C8D-4654-A1B3-51563B298BDA v1.0 UserMgrCli
bindings:
ncalrpc:[LRPC-9eacdcee2e8e2dc6a2]
ncacn_ip_tcp:10.10.10.169[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\RESOLUTE[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
protocol: N/A
provider: N/A
uuid : B18FBAB6-56F8-4702-84E0-41053293A869 v1.0 UserMgrCli
bindings:
ncalrpc:[LRPC-9eacdcee2e8e2dc6a2]
ncacn_ip_tcp:10.10.10.169[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\RESOLUTE[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
protocol: N/A
provider: N/A
uuid : 3A9EF155-691D-4449-8D05-09AD57031823 v1.0
bindings:
ncacn_ip_tcp:10.10.10.169[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\RESOLUTE[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: schedsvc.dll
uuid : 86D35949-83C9-4044-B424-DB363231FD0C v1.0
bindings:
ncacn_ip_tcp:10.10.10.169[49666]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\RESOLUTE[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: taskcomp.dll
uuid : 378E52B0-C0A9-11CF-822D-00AA0051E40F v1.0
bindings:
ncacn_np:\\RESOLUTE[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: taskcomp.dll
uuid : 1FF70682-0A51-30E8-076D-740BE8CEE98B v1.0
bindings:
ncacn_np:\\RESOLUTE[\PIPE\atsvc]
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
protocol: N/A
provider: schedsvc.dll
uuid : 0A74EF1C-41A4-4E06-83AE-DC74FB1CDD53 v1.0
bindings:
ncalrpc:[senssvc]
ncalrpc:[OLE1640D51A500EA6B41B457126196D]
ncalrpc:[IUserProfile2]
protocol: N/A
provider: gpsvc.dll
uuid : 2EB08E3E-639F-4FBA-97B1-14F878961076 v1.0 Group Policy RPC Interface
bindings:
ncalrpc:[LRPC-02745da98598a475ee]
protocol: N/A
provider: N/A
uuid : DF4DF73A-C52D-4E3A-8003-8437FDF8302A v0.0 WM_WindowManagerRPC\Server
bindings:
ncalrpc:[LRPC-ba58d244493f71a0df]
ncalrpc:[OLEFCE1D537CFD375FF05D3B000F0FB]
ncalrpc:[LRPC-3e347c4d6af858110a]
ncalrpc:[LRPC-707be39d907a9fbde1]
protocol: N/A
provider: MPSSVC.dll
uuid : 2FB92682-6599-42DC-AE13-BD2CA89BD11C v1.0 Fw APIs
bindings:
ncalrpc:[LRPC-3e347c4d6af858110a]
ncalrpc:[LRPC-707be39d907a9fbde1]
protocol: N/A
provider: N/A
uuid : F47433C3-3E9D-4157-AAD4-83AA1F5C2D4C v1.0 Fw APIs
bindings:
ncalrpc:[LRPC-3e347c4d6af858110a]
ncalrpc:[LRPC-707be39d907a9fbde1]
protocol: N/A
provider: MPSSVC.dll
uuid : 7F9D11BF-7FB9-436B-A812-B2D50C5D4C03 v1.0 Fw APIs
bindings:
ncalrpc:[LRPC-3e347c4d6af858110a]
ncalrpc:[LRPC-707be39d907a9fbde1]
protocol: N/A
provider: BFE.DLL
uuid : DD490425-5325-4565-B774-7E27D6C09C24 v1.0 Base Firewall Engine API
bindings:
ncalrpc:[LRPC-707be39d907a9fbde1]
protocol: N/A
provider: N/A
uuid : 7F1343FE-50A9-4927-A778-0C5859517BAC v1.0 DfsDs service
bindings:
ncacn_np:\\RESOLUTE[\PIPE\wkssvc]
ncalrpc:[LRPC-5bfd1756bc3ea2e50c]
ncalrpc:[DNSResolver]
protocol: N/A
provider: N/A
uuid : EB081A0D-10EE-478A-A1DD-50995283E7A8 v3.0 Witness Client Test Interface
bindings:
ncalrpc:[LRPC-5bfd1756bc3ea2e50c]
ncalrpc:[DNSResolver]
protocol: N/A
provider: N/A
uuid : F2C9B409-C1C9-4100-8639-D8AB1486694A v1.0 Witness Client Upcall Server
bindings:
ncalrpc:[LRPC-5bfd1756bc3ea2e50c]
ncalrpc:[DNSResolver]
protocol: [MS-FASP]: Firewall and Advanced Security Protocol
provider: FwRemoteSvr.dll
uuid : 6B5BDD1E-528C-422C-AF8C-A4079BE4FE48 v1.0 Remote Fw APIs
bindings:
ncacn_ip_tcp:10.10.10.169[49671]
ncalrpc:[ipsec]
protocol: N/A
provider: efssvc.dll
uuid : 04EEB297-CBF4-466B-8A2A-BFD6A2F10BBA v1.0 EFSK RPC Interface
bindings:
ncacn_np:\\RESOLUTE[\pipe\efsrpc]
ncalrpc:[LRPC-4fe0a3b455f6141e12]
protocol: N/A
provider: efssvc.dll
uuid : DF1941C5-FE89-4E79-BF10-463657ACF44D v1.0 EFS RPC Interface
bindings:
ncacn_np:\\RESOLUTE[\pipe\efsrpc]
ncalrpc:[LRPC-4fe0a3b455f6141e12]
protocol: [MS-NRPC]: Netlogon Remote Protocol
provider: netlogon.dll
uuid : 12345678-1234-ABCD-EF00-01234567CFFB v1.0
bindings:
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\RESOLUTE[\pipe\370af8847511be5d]
ncacn_http:10.10.10.169[49679]
ncalrpc:[NTDS_LPC]
ncacn_ip_tcp:10.10.10.169[49678]
ncalrpc:[OLE73F3DDEB64592CCC19B1695B94A5]
ncacn_ip_tcp:10.10.10.169[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\RESOLUTE[\pipe\lsass]
protocol: [MS-RAA]: Remote Authorization API Protocol
provider: N/A
uuid : 0B1C2170-5732-4E0E-8CD3-D9B16F3B84D7 v0.0 RemoteAccessCheck
bindings:
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\RESOLUTE[\pipe\370af8847511be5d]
ncacn_http:10.10.10.169[49679]
ncalrpc:[NTDS_LPC]
ncacn_ip_tcp:10.10.10.169[49678]
ncalrpc:[OLE73F3DDEB64592CCC19B1695B94A5]
ncacn_ip_tcp:10.10.10.169[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\RESOLUTE[\pipe\lsass]
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\RESOLUTE[\pipe\370af8847511be5d]
ncacn_http:10.10.10.169[49679]
ncalrpc:[NTDS_LPC]
ncacn_ip_tcp:10.10.10.169[49678]
ncalrpc:[OLE73F3DDEB64592CCC19B1695B94A5]
ncacn_ip_tcp:10.10.10.169[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\RESOLUTE[\pipe\lsass]
protocol: [MS-LSAT]: Local Security Authority (Translation Methods) Remote
provider: lsasrv.dll
uuid : 12345778-1234-ABCD-EF00-0123456789AB v0.0
bindings:
ncacn_np:\\RESOLUTE[\pipe\370af8847511be5d]
ncacn_http:10.10.10.169[49679]
ncalrpc:[NTDS_LPC]
ncacn_ip_tcp:10.10.10.169[49678]
ncalrpc:[OLE73F3DDEB64592CCC19B1695B94A5]
ncacn_ip_tcp:10.10.10.169[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\RESOLUTE[\pipe\lsass]
protocol: [MS-DRSR]: Directory Replication Service (DRS) Remote Protocol
provider: ntdsai.dll
uuid : E3514235-4B06-11D1-AB04-00C04FC2DCD2 v4.0 MS NT Directory DRS Interface
bindings:
ncacn_np:\\RESOLUTE[\pipe\370af8847511be5d]
ncacn_http:10.10.10.169[49679]
ncalrpc:[NTDS_LPC]
ncacn_ip_tcp:10.10.10.169[49678]
ncalrpc:[OLE73F3DDEB64592CCC19B1695B94A5]
ncacn_ip_tcp:10.10.10.169[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\RESOLUTE[\pipe\lsass]
protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol
provider: samsrv.dll
uuid : 12345778-1234-ABCD-EF00-0123456789AC v1.0
bindings:
ncacn_ip_tcp:10.10.10.169[49678]
ncalrpc:[OLE73F3DDEB64592CCC19B1695B94A5]
ncacn_ip_tcp:10.10.10.169[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\RESOLUTE[\pipe\lsass]
protocol: N/A
provider: N/A
uuid : 1A0D010F-1C33-432C-B0F5-8CF4E8053099 v1.0 IdSegSrv service
bindings:
ncalrpc:[LRPC-fe5d96f7ad81c8a6a2]
protocol: N/A
provider: srvsvc.dll
uuid : 98716D03-89AC-44C7-BB8C-285824E51C4A v1.0 XactSrv service
bindings:
ncalrpc:[LRPC-fe5d96f7ad81c8a6a2]
protocol: N/A
provider: N/A
uuid : E38F5360-8572-473E-B696-1B46873BEEAB v1.0
bindings:
ncalrpc:[LRPC-a677cfc236edbce80d]
protocol: N/A
provider: N/A
uuid : 4C9DBF19-D39E-4BB9-90EE-8F7179B20283 v1.0
bindings:
ncalrpc:[LRPC-a677cfc236edbce80d]
protocol: [MS-CMPO]: MSDTC Connection Manager:
provider: msdtcprx.dll
uuid : 906B0CE0-C70B-1067-B317-00DD010662DA v1.0
bindings:
ncalrpc:[LRPC-22debe778675948a04]
ncalrpc:[OLE11976F1A386336F30505EDDFFB39]
ncalrpc:[LRPC-4804434b865b39fb56]
ncalrpc:[LRPC-4804434b865b39fb56]
ncalrpc:[LRPC-4804434b865b39fb56]
protocol: [MS-SCMR]: Service Control Manager Remote Protocol
provider: services.exe
uuid : 367ABB81-9844-35F1-AD32-98F038001003 v2.0
bindings:
ncacn_ip_tcp:10.10.10.169[49684]
protocol: N/A
provider: winlogon.exe
uuid : 12E65DD8-887F-41EF-91BF-8D816C42C2E7 v1.0 Secure Desktop LRPC interface
bindings:
ncalrpc:[WMsgKRpc080221]
protocol: [MS-FRS2]: Distributed File System Replication Protocol
provider: dfsrmig.exe
uuid : 897E2E5F-93F3-4376-9C9C-FD2277495C27 v1.0 Frs2 Service
bindings:
ncacn_ip_tcp:10.10.10.169[49716]
ncalrpc:[OLE313477FFC4962EE8506F489BC159]
protocol: [MS-DNSP]: Domain Name Service (DNS) Server Management
provider: dns.exe
uuid : 50ABC2A4-574D-40B3-9D66-EE4FD5FBA076 v5.0
bindings:
ncacn_ip_tcp:10.10.10.169[54462]
[*] Received 302 endpoints.impacket-rpcdump found a total of 302 RPC endpoints.
IOXIDResolver
┌──(kali㉿kali)-[~/archive/htb/labs/resolute]
└─$ python3 IOXIDResolver.py -t $IP
[*] Retrieving network interface of 10.10.10.169
Address: Resolute
Address: 10.10.10.169IOXIDResolver.py was able to pick up the hostname of the target system.