↓ Skip to main content
Cameron Candau

135 wmi, msrpc

WMI / MSRPC Enumeration (135)
#

Run nmap RPC scripts
#

nmap -p 135 --script=msrpc-enum,rpc-grind $IP

Enumerate RPC endpoints
#

rpcinfo -p $IP
impacket-rpcmap $IP

Connect with rpcclient anonymously
#

rpcclient -U "" -N $IP

Enumerate users and groups with rpcclient
#

rpcclient -U "" -N $IP -c enumdomusers
rpcclient -U "" -N $IP -c enumdomgroups
rpcclient -U "" -N $IP -c querydominfo
rpcclient -U "" -N $IP -c netshareenum

RID brute with NetExec
#

netexec smb $IP -u guest -p '' --rid-brute

Enumerate with lookupsid
#

impacket-lookupsid guest@$IP

Query WMI with credentials
#

impacket-wmiquery "$DOMAIN"/"$USER":"$PASS"@$IP "SELECT * FROM Win32_Service"
impacket-wmiquery "$DOMAIN"/"$USER":"$PASS"@$IP "SELECT * FROM Win32_Process"

Execute with WMI or DCOM
#

impacket-wmiexec "$DOMAIN"/"$USER":"$PASS"@$IP
impacket-dcomexec "$DOMAIN"/"$USER":"$PASS"@$IP

Query registry remotely
#

impacket-reg "$DOMAIN"/"$USER":"$PASS"@$IP query -keyName HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run