> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/ports-and-services/smb-445/rpcclient-smb-tool.md).
# rpcclient（SMB 工具）
> 一个 **RPCClient** 它是一个用于进行远程过程调用的程序。它允许客户端在远程服务器上执行函数或方法，就像它们在本地执行一样。客户端通过网络向服务器发送请求，服务器执行所请求的函数并将结果返回给客户端。这种通信通常用于分布式架构，以促进不同系统之间的交互。
### **连接到域控制器**
**1. 无需认证的初始登录**/ 不提供密码连接到域控制器的命令。该 `-N` 选项告诉 `rpcclient` 不要发送密码：
```bash
rpcclient -U "" 10.10.10.175 -N
```
**2. 域用户枚举**/ 要列出域用户：
```bash
enumdomusers
```
**3. 域组列表**/ 列出域组的命令：
```bash
rpcclient -U "" 10.10.10.161 -N -c 'enumdomgroups'
```
### **用户和组的探查**
**1. 使用密码登录**/ 使用特定密码连接到域控制器：
```bash
rpcclient -U "" 10.10.10.10
```
**2. 识别 Administrators 组成员**/ 要识别 Administrators 组的成员（RID `0x200`):
```bash
rpcclient -U "" 10.10.10.10 -c 'querygroupmem 0x200'
```
**3. 获取特定组中的用户**/ 要获取特定组中的用户（RID `0x1f4`):
```bash
rpcclient -U "" 10.10.10.10 -c 'queryuser 0x1f4'
```
**4. 列出用户描述**/ 要列出所有用户的描述：
```bash
rpcclient -U "" 10.10.10.10 -c 'querydispinfo'
```
### 域枚举
**1. 使用凭据登录域**/ 使用凭据连接到域控制器：
```bash
rpcclient -U 'ldap%nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' 10.10.11.174
```
**2. 域用户列表**
要列出域用户：
```
enumdomusers
```
**3. 域组列表**/ 要列出域中的组：
```bash
enumdomgroups
```
**4. 用户描述**/ 要获取用户描述：
```bash
querydispinfo
```
**5. 将有效用户写入文件**/ 要将所有有效用户写入文件：
```bash
rpcclient -U 'ldap%nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' 10.10.11.174 -c 'enumdomusers' | grep -oP '/[.*?/]' | grep -v 0x |tr -d '[]'
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/ports-and-services/smb-445/rpcclient-smb-tool.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.