──(root㉿kali1)-[~/Desktop/APT] └─# python /usr/share/doc/python3-impacket/examples/rpcdump.py 10.10.10.213 -port 135 Impacket v0.11.0 - Copyright 2023 Fortra [*] Retrieving endpoint list from 10.10.10.213 Protocol: [MS-RSP]: Remote Shutdown Protocol Provider: wininit.exe UUID : D95AFE70-A6D5-4259-822E-2C84DA1DDB0D v1.0 Bindings: ncacn_ip_tcp:10.10.10.213[49664] ncalrpc:[WindowsShutdown] ncacn_np:\\APT[\PIPE\InitShutdown] ncalrpc:[WMsgKRpc06F960] Protocol: N/A Provider: winlogon.exe UUID : 76F226C3-EC14-4325-8A99-6A46348418AF v1.0 Bindings: ncalrpc:[WindowsShutdown] ncacn_np:\\APT[\PIPE\InitShutdown] ncalrpc:[WMsgKRpc06F960] ncalrpc:[WMsgKRpc0721E1] Protocol: N/A Provider: N/A UUID : D09BDEB5-6171-4A34-BFE2-06FA82652568 v1.0 Bindings: ncalrpc:[csebpub] ncalrpc:[LRPC-210510617897c04b7c] ncalrpc:[LRPC-61d174bed600087b78] ncacn_np:\\APT[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-bb9559cac4f77eca43] ncalrpc:[actkernel] ncalrpc:[umpo] ncalrpc:[LRPC-61d174bed600087b78] ncacn_np:\\APT[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-bb9559cac4f77eca43] ncalrpc:[actkernel] ncalrpc:[umpo] ncalrpc:[LRPC-e9091692ad18748129] ncalrpc:[dhcpcsvc] ncalrpc:[dhcpcsvc6] ncacn_ip_tcp:10.10.10.213[49665] ncacn_np:\\APT[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-b9cad58491b09d5089] Protocol: N/A Provider: N/A UUID : 697DCDA9-3BA9-4EB2-9247-E11F1901B0D2 v1.0 Bindings: ncalrpc:[LRPC-210510617897c04b7c] ncalrpc:[LRPC-61d174bed600087b78] ncacn_np:\\APT[\pipe\LSM_API_service] ncalrpc:[LSMApi] ncalrpc:[LRPC-bb9559cac4f77eca43] ncalrpc:[actkernel] ncalrpc:[umpo] Protocol: N/A Provider: sysntfy.dll UUID : C9AC6DB5-82B7-4E55-AE8A-E464ED7B4277 v1.0 Impl friendly name Bindings: ncalrpc:[LRPC-bb9559cac4f77eca43] ncalrpc:[actkernel] ncalrpc:[umpo] ncalrpc:[senssvc] ncalrpc:[OLEDD706D910C447C27B12F564A35B4] ncalrpc:[IUserProfile2] ncalrpc:[IUserProfile2] ncalrpc:[LRPC-4b20397a054edadead] ncalrpc:[OLEBCA6F45D2A6D9CB9195B9BFD085B] ncacn_ip_tcp:10.10.10.213[49667] ncalrpc:[samss lpc] ncalrpc:[SidKey Local End Point] ncalrpc:[protected_storage] ncalrpc:[lsasspirpc] ncalrpc:[lsapolicylookup] ncalrpc:[LSA_EAS_ENDPOINT] ncalrpc:[lsacap] ncalrpc:[LSARPC_ENDPOINT] ncalrpc:[securityevent] ncalrpc:[audit] ncacn_np:\\APT[\pipe\lsass] Protocol: N/A Provider: nsisvc.dll UUID : 7EA70BCF-48AF-4F6A-8968-6A440754D5FA v1.0 NSI server endpoint Bindings: ncalrpc:[LRPC-32ccca8c006e79067c] Protocol: N/A Provider: N/A UUID : A500D4C6-0DD1-4543-BC0C-D5F93486EAF8 v1.0 Bindings: ncalrpc:[LRPC-e2668f3cee8e9bb28a] ncalrpc:[LRPC-e9091692ad18748129] ncalrpc:[dhcpcsvc] ncalrpc:[dhcpcsvc6] ncacn_ip_tcp:10.10.10.213[49665] ncacn_np:\\APT[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-b9cad58491b09d5089] Protocol: N/A Provider: dhcpcsvc.dll UUID : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D5 v1.0 DHCP Client LRPC Endpoint Bindings: ncalrpc:[dhcpcsvc] ncalrpc:[dhcpcsvc6] ncacn_ip_tcp:10.10.10.213[49665] ncacn_np:\\APT[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-b9cad58491b09d5089] Protocol: N/A Provider: dhcpcsvc6.dll UUID : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D6 v1.0 DHCPv6 Client LRPC Endpoint Bindings: ncalrpc:[dhcpcsvc6] ncacn_ip_tcp:10.10.10.213[49665] ncacn_np:\\APT[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-b9cad58491b09d5089] Protocol: [MS-EVEN6]: EventLog Remoting Protocol Provider: wevtsvc.dll UUID : F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C v1.0 Event log TCPIP Bindings: ncacn_ip_tcp:10.10.10.213[49665] ncacn_np:\\APT[\pipe\eventlog] ncalrpc:[eventlog] ncalrpc:[LRPC-b9cad58491b09d5089] Protocol: N/A Provider: nrpsrv.dll UUID : 30ADC50C-5CBC-46CE-9A0E-91914789E23C v1.0 NRP server endpoint Bindings: ncalrpc:[LRPC-b9cad58491b09d5089] Protocol: N/A Provider: IKEEXT.DLL UUID : A398E520-D59A-4BDD-AA7A-3C1E0303A511 v1.0 IKE/Authip API Bindings: ncalrpc:[LRPC-81a623f1641e8e1f62] ncacn_ip_tcp:10.10.10.213[49666] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\APT[\PIPE\atsvc] ncalrpc:[senssvc] ncalrpc:[OLEDD706D910C447C27B12F564A35B4] ncalrpc:[IUserProfile2] Protocol: N/A Provider: N/A UUID : 0D3C7F20-1C8D-4654-A1B3-51563B298BDA v1.0 UserMgrCli Bindings: ncalrpc:[LRPC-81a623f1641e8e1f62] ncacn_ip_tcp:10.10.10.213[49666] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\APT[\PIPE\atsvc] ncalrpc:[senssvc] ncalrpc:[OLEDD706D910C447C27B12F564A35B4] ncalrpc:[IUserProfile2] Protocol: N/A Provider: N/A UUID : B18FBAB6-56F8-4702-84E0-41053293A869 v1.0 UserMgrCli Bindings: ncalrpc:[LRPC-81a623f1641e8e1f62] ncacn_ip_tcp:10.10.10.213[49666] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\APT[\PIPE\atsvc] ncalrpc:[senssvc] ncalrpc:[OLEDD706D910C447C27B12F564A35B4] ncalrpc:[IUserProfile2] Protocol: N/A Provider: N/A UUID : 3A9EF155-691D-4449-8D05-09AD57031823 v1.0 Bindings: ncacn_ip_tcp:10.10.10.213[49666] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\APT[\PIPE\atsvc] ncalrpc:[senssvc] ncalrpc:[OLEDD706D910C447C27B12F564A35B4] ncalrpc:[IUserProfile2] Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol Provider: schedsvc.dll UUID : 86D35949-83C9-4044-B424-DB363231FD0C v1.0 Bindings: ncacn_ip_tcp:10.10.10.213[49666] ncalrpc:[ubpmtaskhostchannel] ncacn_np:\\APT[\PIPE\atsvc] ncalrpc:[senssvc] ncalrpc:[OLEDD706D910C447C27B12F564A35B4] ncalrpc:[IUserProfile2] Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol Provider: taskcomp.dll UUID : 378E52B0-C0A9-11CF-822D-00AA0051E40F v1.0 Bindings: ncacn_np:\\APT[\PIPE\atsvc] ncalrpc:[senssvc] ncalrpc:[OLEDD706D910C447C27B12F564A35B4] ncalrpc:[IUserProfile2] Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol Provider: taskcomp.dll UUID : 1FF70682-0A51-30E8-076D-740BE8CEE98B v1.0 Bindings: ncacn_np:\\APT[\PIPE\atsvc] ncalrpc:[senssvc] ncalrpc:[OLEDD706D910C447C27B12F564A35B4] ncalrpc:[IUserProfile2] Protocol: N/A Provider: schedsvc.dll UUID : 0A74EF1C-41A4-4E06-83AE-DC74FB1CDD53 v1.0 Bindings: ncalrpc:[senssvc] ncalrpc:[OLEDD706D910C447C27B12F564A35B4] ncalrpc:[IUserProfile2] Protocol: N/A Provider: gpsvc.dll UUID : 2EB08E3E-639F-4FBA-97B1-14F878961076 v1.0 Group Policy RPC Interface Bindings: ncalrpc:[LRPC-270d06d26313193ae9] Protocol: N/A Provider: N/A UUID : 7F1343FE-50A9-4927-A778-0C5859517BAC v1.0 DfsDs service Bindings: ncacn_np:\\APT[\PIPE\wkssvc] ncalrpc:[DNSResolver] ncalrpc:[LRPC-9e313ee1e93a3aeb48] Protocol: N/A Provider: N/A UUID : EB081A0D-10EE-478A-A1DD-50995283E7A8 v3.0 Witness Client Test Interface Bindings: ncalrpc:[LRPC-9e313ee1e93a3aeb48] Protocol: N/A Provider: N/A UUID : F2C9B409-C1C9-4100-8639-D8AB1486694A v1.0 Witness Client Upcall Server Bindings: ncalrpc:[LRPC-9e313ee1e93a3aeb48] Protocol: N/A Provider: N/A UUID : DF4DF73A-C52D-4E3A-8003-8437FDF8302A v0.0 WM_WindowManagerRPC\Server Bindings: ncalrpc:[LRPC-8ae523a7e8728c3ae6] ncalrpc:[LRPC-4d5fadc3d7aa1bfe56] ncalrpc:[LRPC-210e9fa76c05026042] Protocol: N/A Provider: MPSSVC.dll UUID : 2FB92682-6599-42DC-AE13-BD2CA89BD11C v1.0 Fw APIs Bindings: ncalrpc:[LRPC-4d5fadc3d7aa1bfe56] ncalrpc:[LRPC-210e9fa76c05026042] Protocol: N/A Provider: N/A UUID : F47433C3-3E9D-4157-AAD4-83AA1F5C2D4C v1.0 Fw APIs Bindings: ncalrpc:[LRPC-4d5fadc3d7aa1bfe56] ncalrpc:[LRPC-210e9fa76c05026042] Protocol: N/A Provider: MPSSVC.dll UUID : 7F9D11BF-7FB9-436B-A812-B2D50C5D4C03 v1.0 Fw APIs Bindings: ncalrpc:[LRPC-4d5fadc3d7aa1bfe56] ncalrpc:[LRPC-210e9fa76c05026042] Protocol: N/A Provider: BFE.DLL UUID : DD490425-5325-4565-B774-7E27D6C09C24 v1.0 Base Firewall Engine API Bindings: ncalrpc:[LRPC-210e9fa76c05026042] Protocol: [MS-NRPC]: Netlogon Remote Protocol Provider: netlogon.dll UUID : 12345678-1234-ABCD-EF00-01234567CFFB v1.0 Bindings: ncalrpc:[NETLOGON_LRPC] ncacn_ip_tcp:10.10.10.213[49670] ncacn_np:\\APT[\pipe\82002a8629cc5a8f] ncacn_http:10.10.10.213[49669] ncalrpc:[NTDS_LPC] ncalrpc:[OLEBCA6F45D2A6D9CB9195B9BFD085B] ncacn_ip_tcp:10.10.10.213[49667] ncalrpc:[samss lpc] ncalrpc:[SidKey Local End Point] ncalrpc:[protected_storage] ncalrpc:[lsasspirpc] ncalrpc:[lsapolicylookup] ncalrpc:[LSA_EAS_ENDPOINT] ncalrpc:[lsacap] ncalrpc:[LSARPC_ENDPOINT] ncalrpc:[securityevent] ncalrpc:[audit] ncacn_np:\\APT[\pipe\lsass] Protocol: [MS-RAA]: Remote Authorization API Protocol Provider: N/A UUID : 0B1C2170-5732-4E0E-8CD3-D9B16F3B84D7 v0.0 RemoteAccessCheck Bindings: ncalrpc:[NETLOGON_LRPC] ncacn_ip_tcp:10.10.10.213[49670] ncacn_np:\\APT[\pipe\82002a8629cc5a8f] ncacn_http:10.10.10.213[49669] ncalrpc:[NTDS_LPC] ncalrpc:[OLEBCA6F45D2A6D9CB9195B9BFD085B] ncacn_ip_tcp:10.10.10.213[49667] ncalrpc:[samss lpc] ncalrpc:[SidKey Local End Point] ncalrpc:[protected_storage] ncalrpc:[lsasspirpc] ncalrpc:[lsapolicylookup] ncalrpc:[LSA_EAS_ENDPOINT] ncalrpc:[lsacap] ncalrpc:[LSARPC_ENDPOINT] ncalrpc:[securityevent] ncalrpc:[audit] ncacn_np:\\APT[\pipe\lsass] ncalrpc:[NETLOGON_LRPC] ncacn_ip_tcp:10.10.10.213[49670] ncacn_np:\\APT[\pipe\82002a8629cc5a8f] ncacn_http:10.10.10.213[49669] ncalrpc:[NTDS_LPC] ncalrpc:[OLEBCA6F45D2A6D9CB9195B9BFD085B] ncacn_ip_tcp:10.10.10.213[49667] ncalrpc:[samss lpc] ncalrpc:[SidKey Local End Point] ncalrpc:[protected_storage] ncalrpc:[lsasspirpc] ncalrpc:[lsapolicylookup] ncalrpc:[LSA_EAS_ENDPOINT] ncalrpc:[lsacap] ncalrpc:[LSARPC_ENDPOINT] ncalrpc:[securityevent] ncalrpc:[audit] ncacn_np:\\APT[\pipe\lsass] Protocol: N/A Provider: efssvc.dll UUID : 04EEB297-CBF4-466B-8A2A-BFD6A2F10BBA v1.0 EFSK RPC Interface Bindings: ncacn_np:\\APT[\pipe\efsrpc] ncalrpc:[LRPC-7a22dd118a29f031d9] Protocol: N/A Provider: efssvc.dll UUID : DF1941C5-FE89-4E79-BF10-463657ACF44D v1.0 EFS RPC Interface Bindings: ncacn_np:\\APT[\pipe\efsrpc] ncalrpc:[LRPC-7a22dd118a29f031d9] Protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol Provider: samsrv.dll UUID : 12345778-1234-ABCD-EF00-0123456789AC v1.0 Bindings: ncacn_ip_tcp:10.10.10.213[49670] ncacn_np:\\APT[\pipe\82002a8629cc5a8f] ncacn_http:10.10.10.213[49669] ncalrpc:[NTDS_LPC] ncalrpc:[OLEBCA6F45D2A6D9CB9195B9BFD085B] ncacn_ip_tcp:10.10.10.213[49667] ncalrpc:[samss lpc] ncalrpc:[SidKey Local End Point] ncalrpc:[protected_storage] ncalrpc:[lsasspirpc] ncalrpc:[lsapolicylookup] ncalrpc:[LSA_EAS_ENDPOINT] ncalrpc:[lsacap] ncalrpc:[LSARPC_ENDPOINT] ncalrpc:[securityevent] ncalrpc:[audit] ncacn_np:\\APT[\pipe\lsass] Protocol: [MS-LSAT]: Local Security Authority (Translation Methods) Remote Provider: lsasrv.dll UUID : 12345778-1234-ABCD-EF00-0123456789AB v0.0 Bindings: ncacn_np:\\APT[\pipe\82002a8629cc5a8f] ncacn_http:10.10.10.213[49669] ncalrpc:[NTDS_LPC] ncalrpc:[OLEBCA6F45D2A6D9CB9195B9BFD085B] ncacn_ip_tcp:10.10.10.213[49667] ncalrpc:[samss lpc] ncalrpc:[SidKey Local End Point] ncalrpc:[protected_storage] ncalrpc:[lsasspirpc] ncalrpc:[lsapolicylookup] ncalrpc:[LSA_EAS_ENDPOINT] ncalrpc:[lsacap] ncalrpc:[LSARPC_ENDPOINT] ncalrpc:[securityevent] ncalrpc:[audit] ncacn_np:\\APT[\pipe\lsass] Protocol: [MS-DRSR]: Directory Replication Service (DRS) Remote Protocol Provider: ntdsai.dll UUID : E3514235-4B06-11D1-AB04-00C04FC2DCD2 v4.0 MS NT Directory DRS Interface Bindings: ncacn_np:\\APT[\pipe\82002a8629cc5a8f] ncacn_http:10.10.10.213[49669] ncalrpc:[NTDS_LPC] ncalrpc:[OLEBCA6F45D2A6D9CB9195B9BFD085B] ncacn_ip_tcp:10.10.10.213[49667] ncalrpc:[samss lpc] ncalrpc:[SidKey Local End Point] ncalrpc:[protected_storage] ncalrpc:[lsasspirpc] ncalrpc:[lsapolicylookup] ncalrpc:[LSA_EAS_ENDPOINT] ncalrpc:[lsacap] ncalrpc:[LSARPC_ENDPOINT] ncalrpc:[securityevent] ncalrpc:[audit] ncacn_np:\\APT[\pipe\lsass] Protocol: N/A Provider: N/A UUID : 1A0D010F-1C33-432C-B0F5-8CF4E8053099 v1.0 IdSegSrv service Bindings: ncalrpc:[LRPC-8217f019cae4f90749] Protocol: N/A Provider: srvsvc.dll UUID : 98716D03-89AC-44C7-BB8C-285824E51C4A v1.0 XactSrv service Bindings: ncalrpc:[LRPC-8217f019cae4f90749] Protocol: N/A Provider: N/A UUID : E38F5360-8572-473E-B696-1B46873BEEAB v1.0 Bindings: ncalrpc:[LRPC-39df922fbff65f61fa] Protocol: N/A Provider: N/A UUID : 4C9DBF19-D39E-4BB9-90EE-8F7179B20283 v1.0 Bindings: ncalrpc:[LRPC-39df922fbff65f61fa] Protocol: [MS-SCMR]: Service Control Manager Remote Protocol Provider: services.exe UUID : 367ABB81-9844-35F1-AD32-98F038001003 v2.0 Bindings: ncacn_ip_tcp:10.10.10.213[49674] Protocol: [MS-CMPO]: MSDTC Connection Manager: Provider: msdtcprx.dll UUID : 906B0CE0-C70B-1067-B317-00DD010662DA v1.0 Bindings: ncalrpc:[LRPC-051823d200b188b06b] ncalrpc:[OLEF43ACE2ACA345EDBAA3B9C1D9A11] ncalrpc:[LRPC-56a6cd376832b055f1] ncalrpc:[LRPC-56a6cd376832b055f1] ncalrpc:[LRPC-56a6cd376832b055f1] Protocol: N/A Provider: winlogon.exe UUID : 12E65DD8-887F-41EF-91BF-8D816C42C2E7 v1.0 Secure Desktop LRPC interface Bindings: ncalrpc:[WMsgKRpc0721E1] Protocol: [MS-DNSP]: Domain Name Service (DNS) Server Management Provider: dns.exe UUID : 50ABC2A4-574D-40B3-9D66-EE4FD5FBA076 v5.0 Bindings: ncacn_ip_tcp:10.10.10.213[49695] Protocol: [MS-FRS2]: Distributed File System Replication Protocol Provider: dfsrmig.exe UUID : 897E2E5F-93F3-4376-9C9C-FD2277495C27 v1.0 Frs2 Service Bindings: ncacn_ip_tcp:10.10.10.213[54029] ncalrpc:[OLE5E7C7BEE55B39E3C0FD9AC36BD55] [*] Received 263 endpoints.
python /usr/share/doc/python3-impacket/examples/rpcdump.py 10.10.10.213 -port 135
Â