tldr/pages/common/rpcmap.py.md

rpcmap.py

Lookup listening MSRPC interfaces using a string binding (e.g., ncacn_ip_tcp:host[port]). Part of the Impacket suite. More information: https://github.com/fortra/impacket.

• Connect to an MSRPC interface using a string binding (e.g., ncacn_ip_tcp:host[port]):

rpcmap.py {{stringbinding}}

• Bruteforce UUIDs even if the MGMT interface is available:

rpcmap.py -brute-uuids {{stringbinding}}

• Bruteforce operation numbers (opnums) for discovered UUIDs:

rpcmap.py -brute-opnums {{stringbinding}}

• Bruteforce major versions of found UUIDs:

rpcmap.py -brute-versions {{stringbinding}}

• Specify a target IP address manually:

rpcmap.py -target-ip {{ip_address}} {{stringbinding}}

• Authenticate to the RPC interface with username and password:

rpcmap.py -auth-rpc {{domain}}/{{username}}:{{password}} {{stringbinding}}

• Authenticate using NTLM hashes for RPC:

rpcmap.py -hashes-rpc {{LMHASH:NTHASH}} {{stringbinding}}

• Enable debug output for verbose information:

rpcmap.py -debug {{stringbinding}}