Impacket rpcdump.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Queries the Endpoint Mapper and lists the RPC interfaces and connection details exposed by a target host.
| Item | Details |
|---|---|
| Implementation | examples/rpcdump.py |
| Category | SMB / MSRPC / NTLM |
| Size | 208 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/rpcdump.py -h for the current option definitions.
| Argument | Description |
|---|---|
target | [[domain/]username[:password]@] |
-debug | Enable debug output |
-ts | Add a timestamp to each log message |
-target-ip | Target machine IP address; if omitted, use the target value. Useful when a NetBIOS target name cannot be resolved |
-port | Port for the RPC Endpoint Mapper (choices: 135, 139, 443, 445, 593; default: 135) |
-hashes | NTLM hashes in LMHASH:NTHASH format |
Detailed processing flow
Section titled “Detailed processing flow”The tool builds a transport over ports such as 135, 139, 445, or 443, binds to the EPM interface, pages through hept_lookup, and parses towers. It maps UUIDs to known names, groups entries by binding, and displays them.
How it works
Section titled “How it works”The Endpoint Mapper stores registration information for RPC interfaces and
binding endpoints on a host. rpcdump connects to the EPM interface and repeatedly
calls ept_lookup to retrieve towers and annotations. Rather than scanning ports,
it asks the RPC runtime which interface UUIDs, versions, and protocol sequences it exposes.
A tower has multiple floors representing interface UUIDs, transfer syntaxes,
TCP ports, named pipes, hosts or addresses, and other details. The epm helper
converts floors into string bindings and adds human-readable protocol names
by checking a database of known UUIDs. An interface may have multiple registered endpoints or bindings.
EPM responses use pages and context handles, so the first response may not contain every entry. Connection failures also mean different things for RPC over HTTP, SMB transport, and TCP. Even when annotations are empty, UUIDs are unknown, or tower floors are unsupported, an analysis tool should display the raw UUID, version, and binding.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
RPCDump | 36 | __init__(), dump() |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket.http | AUTH_NTLM |
impacket.examples | logger |
impacket.examples.utils | parse_target |
impacket | uuid, version |
impacket.dcerpc.v5 | epm, transport |
impacket.dcerpc.v5.rpch | RPC_PROXY_CONN_A1_0X6BA_ERR, RPC_PROXY_CONN_A1_404_ERR, RPC_PROXY_INVALID_RPC_PORT_ERR, RPC_PROXY_RPC_OUT_DATA_404_ERR |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- The tool primarily makes queries and authentication attempts. Frequent runs can affect audit logs, account lockouts, and target load.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
When changing the implementation
Section titled “When changing the implementation”The code depends on dcerpc.v5.epm, transport, rpch, impacket.uuid, and HTTP NTLM authentication. RPCDump.dump() selects the transport and enumerates interfaces, retaining RPC-over-HTTP-specific errors for diagnosis.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/rpcdump.py - CLI:
python examples/rpcdump.py -h - Related test:
tests/SMB_RPC/test_rpch.py - Related test:
tests/misc/test_dcerpc_v5_ndr.py