> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/ports-and-services/smb-445/rpcclient-smb-tool.md).
# rpcclient（SMB 工具）
使用 rpcclient 进行 SMB 和 Active Directory 枚举，涵盖用户、组、RID、描述和空会话。
> 一个 **RPCClient** 它是一个用于进行远程过程调用的程序。它允许客户端在远程服务器上执行函数或方法，就像它们在本地执行一样。客户端通过网络向服务器发送请求，服务器执行所请求的函数，并将结果返回给客户端。这种通信通常用于分布式架构中，以促进不同系统之间的交互。
### **连接到域控制器**
**1. 未经身份验证的初始登录**/ 无需提供密码即可连接到域控制器的命令。 `-N` 该选项表示 `rpcclient` 不要发送密码：
```bash
rpcclient -U "" 10.10.10.175 -N
```
**2. 枚举域用户**/ 列出域用户：
```bash
enumdomusers
```
**3. 域组列表**/ 列出域组的命令：
```bash
rpcclient -U "" 10.10.10.161 -N -c 'enumdomgroups'
```
### **用户和组的探查**
**1. 使用密码登录**/ 使用指定密码连接到域控制器：
```bash
rpcclient -U "" 10.10.10.10
```
**2. 识别 Administrators 组成员**/ 要识别 Administrators 组成员（RID `0x200`):
```bash
rpcclient -U "" 10.10.10.10 -c 'querygroupmem 0x200'
```
**3. 获取特定组中的用户**/ 要获取特定组中的用户（RID `0x1f4`):
```bash
rpcclient -U "" 10.10.10.10 -c 'queryuser 0x1f4'
```
**4. 列出用户描述**/ 列出所有用户的描述：
```bash
rpcclient -U "" 10.10.10.10 -c 'querydispinfo'
```
### 域枚举
**1. 使用凭据登录域**/ 使用凭据连接到域控制器：
```bash
rpcclient -U 'ldap%nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' 10.10.11.174
```
**2. 域用户列表**
要列出域用户：
```
enumdomusers
```
**3. 域组列表**/ 列出域中的组：
```bash
enumdomgroups
```
**4. 用户描述**/ 获取用户描述：
```bash
querydispinfo
```
**5. 将有效用户写入文件**/ 将所有有效用户写入文件：
```bash
rpcclient -U 'ldap%nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' 10.10.11.174 -c 'enumdomusers' | grep -oP '/[.*?/]' | grep -v 0x |tr -d '[]'
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/ports-and-services/smb-445/rpcclient-smb-tool.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)