> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/rpc.md).

# RPC

RPC, or **Remote Procedure Call**, is a protocol that allows a program to execute code or procedures on a different address space—often on another computer on a shared network—**as if it were a local procedure call**.

`Default RPC Ports: 135 (TCP)`

### Banner Grabbing

You can manually grab the RPC banner with `nc`:

```bash
nc <target-ip> 135
```

***

### Nmap NSE Scripts for RPC

```bash
nmap -p 135 --script=rpcinfo <target-ip>
```

| Script    | Description                                      |
| --------- | ------------------------------------------------ |
| `rpcinfo` | Enumerates RPC programs and ports via Portmapper |

***

### RPC Enumeration Tools

### **rpcinfo**

```bash
rpcinfo -p <target-ip>
```

Lists all RPC services running and the ports they are using.

***

### **rpcclient**

```bash
rpcclient -U "" <target-ip>
```

Common commands inside `rpcclient`:

```bash
srvinfo               # Basic system information
enumdomusers          # Enumerate domain users
queryuser <RID>       # Query specific user info
enumdomgroups         # List domain groups
enumprivs             # List privileges
netshareenum          # Enumerate shares
getusername           # Get current user
```

If credentials are required:

```bash
rpcclient -U <user>%<password> <target-ip>
```