📑
Security Notes
  • Readme
  • Resources
    • Useful sites
    • Metasploit
      • Searchsploit
      • Msfvenom
      • Meterpreter
    • Shells
    • Linux
      • Cron
      • Connection
      • Compilers
    • Windows
      • Kernel exploits table
    • Bruteforce
      • Checklist
      • John the Ripper
      • Hashcat
    • BOF
      • Assembly
    • Gaining access checklist
  • Cloud - AWS
    • Enumeration
    • References
    • Bucket S3
      • Public Bucket
      • AMI Files
      • File upload to RCE
    • EC2
      • cloud-init Exploits
      • SSRF To AWS Role compromise
      • Unencrypted EBS
    • IAM
      • Account Disclosure by resource policy
    • Lambda Function
      • Code Injection
      • Attacking APIs
    • VPC
      • Expose Resources
  • Networking
    • Nmap
      • Scan types
    • TCPDump
    • Port forwarding
    • Ports
      • 21 - FTP
      • 22 - SSH
      • 25 465 587 - SMTP
      • 53 - DNS
      • 110 995 - POP3
      • 111 - NFS
      • 113 - Ident
      • 123 - NTP
      • 135 137 139 - RPC
      • 143 993 - IMAP
      • 161 - SNMP
      • 389 - LDAP
      • 139 445 - SMB
      • 873 - Rsync
      • 6379 - Redis
      • 6667 - IRC
  • Linux PrivEsc
    • Checklist
    • Enumeration
      • Important files
      • Memory Dump
    • Privileges Exploitation
    • Wildcard Exploits
    • Sudo Exploits
    • Docker Container
    • Docker Groups
    • Common Exploits
  • Windows PrivEsc
    • Checklist
    • Enumeration
      • Important Files
    • Antivirus evasion tools
    • Unquoted paths
    • Always install elevated
    • Vulnerable services
    • Client side
    • Exploitable privileges
      • Juicy Potato
    • UAC bypass
    • Common Exploits
  • Active Directory
    • Introduction
    • Checklist
    • Enumeration
    • Enable RDP
    • Kerberos
    • Rubeus
    • Credentials harvesting
      • Domain Controller specific
    • Connection
    • Pass The Hash
    • Kerberoast
    • ASREProast
    • Tickets
  • Web Attacks
    • Checklist
    • Enumeration
      • URL bruteforcing
    • APIs and Fields
    • Authentication
    • Filter Evasion
      • Fuzzying and encoding
    • File Vulnerabilities
      • LFI List
      • PHP shells
    • RCE
    • Code Injection
    • Dependency Injection
    • Joomla
    • Wordpress
    • WebDAV
    • HTTP
    • XSS
      • DOM Based
      • Reflected
      • Filter Evasion
    • SSI
    • SSTI
    • RCE
    • CSRF
    • SQL injection
      • sqlmap
      • PostgreSQL
      • Oracle
      • MSSQL
      • MySQL
      • Login
    • XPath injection
    • XXE
    • CORS
  • MOBILE PENTESTING
    • Static Code Analysis
    • Dynamic Code Analysis
    • Network Traffic Analysis
Powered by GitBook
On this page
  • Login & Enumeration
  • RPC commands
  • Server and shares
  • Users and passwords
  1. Networking
  2. Ports

135 137 139 - RPC

Login & Enumeration

rpcclient -U "" -N <ip>          #anonymous login
rpcclient -U "<user>" -N <ip>    #anonymous login

RPC commands

Server and shares

srvinfo                Server query info
netshareenum           Enumerate shares
netshareenumall        Enumerate all shares
netsharegetinfo        Get Share Info
netsharesetinfo        Set Share Info
netsharesetdfsflags    Set DFS flags
netfileenum            Enumerate open files
netremotetod           Fetch remote time of day
netnamevalidate        Validate sharename
netfilegetsec          Get File security
netsessdel             Delete Session
netsessenum            Enumerate Sessions
netdiskenum            Enumerate Disks
netconnenum            Enumerate Connections
netshareadd            Add share
netsharedel            Delete share

Users and passwords

queryuser             Query user info
querygroup            Query group info
queryusergroups       Query user groups
queryuseraliases		  Query user aliases
querygroupmem         Query group membership
queryaliasmem         Query alias membership
queryaliasinfo        Query alias info
deletealias           Delete an alias
querydispinfo         Query display info
querydispinfo2        Query display info
querydispinfo3        Query display info
querydominfo          Query domain info
enumdomusers          Enumerate domain users
enumdomgroups         Enumerate domain groups
enumalsgroups         Enumerate alias groups
enumdomains           Enumerate domains
createdomuser         Create domain user
createdomgroup        Create domain group
createdomalias        Create domain alias
samlookupnames        Look up names
samlookuprids         Look up names
deletedomgroup		    Delete domain group
deletedomuser         Delete domain user
samquerysecobj        Query SAMR security object
getdompwinfo          Retrieve domain password info
getusrdompwinfo       Retrieve user domain password info
lookupdomain          Lookup Domain Name
chgpasswd             Change user password
getdispinfoidx        Get Display Information Index
setuserinfo           Set user info
Previous123 - NTPNext143 993 - IMAP

Last updated 2 years ago