> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/ports-and-services/smb-445/rpcclient-smb-tool.md).
# rpcclient (SMB Tool)
SMB and Active Directory enumeration with rpcclient for users, groups, RIDs, descriptions, and null sessions.
> An **RPCClient** is a program for making remote procedure calls. It allows a client to execute functions or methods on a remote server, as if they were executed locally. The client sends a request to the server over a network, and the server performs the requested function and returns the result to the client. This communication is commonly used in distributed architectures to facilitate interaction between different systems.
### **Connection to the domain controller**
**1. Initial login without authentication**/ Command to connect to the domain controller without providing a password. The `-N` option tells `rpcclient` not to send a password:
```bash
rpcclient -U "" 10.10.10.175 -N
```
**2. Enumeration of domain users**/ To list domain users:
```bash
enumdomusers
```
**3. List of domain groups**/ Command to list domain groups:
```bash
rpcclient -U "" 10.10.10.161 -N -c 'enumdomgroups'
```
### **Exploration of users and groups**
**1. Login with password**/ Connecting to the domain controller with a specific password:
```bash
rpcclient -U "" 10.10.10.10
```
**2. Identify members of the Administrators group**/ To identify members of the Administrators group (RID `0x200`):
```bash
rpcclient -U "" 10.10.10.10 -c 'querygroupmem 0x200'
```
**3. Get users in a specific group**/ To get users in a specific group (RID `0x1f4`):
```bash
rpcclient -U "" 10.10.10.10 -c 'queryuser 0x1f4'
```
**4. List user descriptions**/ To list descriptions for all users:
```bash
rpcclient -U "" 10.10.10.10 -c 'querydispinfo'
```
### Domain enumeration
**1. Logging in to the domain with credentials**/ Connecting to the domain controller with credentials:
```bash
rpcclient -U 'ldap%nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' 10.10.11.174
```
**2. List of domain users**
To list domain users:
```
enumdomusers
```
**3. List of domain groups**/ To list the groups in the domain:
```bash
enumdomgroups
```
**4. Description of users**/ To get user descriptions:
```bash
querydispinfo
```
**5. Inserting valid users into a file**/ To insert all valid users into a file:
```bash
rpcclient -U 'ldap%nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' 10.10.11.174 -c 'enumdomusers' | grep -oP '/[.*?/]' | grep -v 0x |tr -d '[]'
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/ports-and-services/smb-445/rpcclient-smb-tool.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)