Impacket rpcmap.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Checks which UUIDs, versions, and opnums are available at a specified DCE/RPC endpoint, using the management interface or active probing.
| Item | Details |
|---|---|
| Implementation | examples/rpcmap.py |
| Category | SMB / MSRPC / NTLM |
| Size | 378 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/rpcmap.py -h for the current option definitions.
| Argument | Description |
|---|---|
stringbinding | String binding for the MSRPC interface, for example: ncacn_ip_tcp:192.168.0.1[135] ncacn_np:192.168.0.1[\pipe\spoolss] ncacn_http:192.168.0.1[593] ncacn_http:[6001,RpcProxy=exchange.contoso.com:443] ncacn_http:localhost[3388,RpcProxy=rds.contoso:443] |
-brute-uuids | Brute-force UUIDs even when the management interface is available. |
-brute-opnums | Brute-force opnums for discovered UUIDs. |
-brute-versions | Brute-force major versions of discovered UUIDs. |
-opnum-max | Brute-force opnums from 0 to N (default: 64). |
-version-max | Brute-force versions from 0 to N (default: 64). |
-auth-level | MS-RPCE authentication level from 1 to 6 (default: 6, RPC_C_AUTHN_LEVEL_PKT_PRIVACY). |
-uuid | Test only this UUID. |
-debug | Enable debug output. |
-ts | Add a timestamp to each log message. |
-target-ip | Target IP address; if omitted, use the target value. Useful when the target is a NetBIOS name that cannot be resolved. |
-port | Destination SMB server port (choices: 139, 445; default: 445) |
-auth-rpc | [domain/]username[:password] |
-auth-transport | [domain/]username[:password] |
-hashes-rpc | NTLM hashes in LMHASH:NTHASH format. |
-hashes-transport | NTLM hashes in LMHASH:NTHASH format. |
-no-pass | Do not prompt for passwords. |
Detailed processing flow
Section titled “Detailed processing flow”The tool configures transport and RPC credentials separately and connects using the specified binding. It normally lists interfaces through the management interface; with the relevant options, it binds to candidate UUIDs and versions, calls candidate opnums, and classifies responses and faults. It looks up discovered tuples in a database of known UUIDs before displaying them.
How it works
Section titled “How it works”In addition to listing known endpoints, rpcmap actively probes interfaces
over a specified string binding. After connecting through the transport, it
gets the interface IDs enumerated by the server if the management interface is
available. Otherwise, or when explicitly requested, it binds or calls candidate UUIDs, versions, and opnums and classifies returned faults.
RPC transport authentication and RPC interface authentication have separate
settings. For example, with RPC over SMB, SMB session credentials open the named
pipe, while the DCE/RPC authentication trailer can use different credentials and
an authentication level. This is why set_transport_credentials() and set_rpc_credentials() are separate.
A successful bind indicates that an interface and version exist. An
op_rng_error can show that the interface exists but the opnum is out of range,
while access denied leaves open the possibility that the opnum exists. Brute-force
probing creates network load and logs. Its accuracy depends on managing limits,
reconnections, and timeouts without reducing fault codes to simple success or failure.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
RPCMap | 54 | __init__(), get_rpc_transport(), set_transport_credentials(), set_rpc_credentials(), set_smb_info(), connect(), disconnect(), do(), bruteforce_versions(), bruteforce_opnums(), bruteforce_uuids(), handle_discovered_tup() |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket.http | AUTH_BASIC |
impacket.examples | logger, rpcdatabase |
impacket.examples.utils | parse_identity |
impacket | uuid, version |
impacket.dcerpc.v5.epm | KNOWN_UUIDS |
impacket.dcerpc.v5 | epm, mgmt, rpcrt, transport |
impacket.dcerpc.v5.rpcrt | DCERPCException |
impacket.dcerpc.v5.transport | DCERPCStringBinding, SMBTransport |
impacket.dcerpc.v5.rpch | RPC_PROXY_CONN_A1_0X6BA_ERR, RPC_PROXY_CONN_A1_401_ERR, RPC_PROXY_CONN_A1_404_ERR, RPC_PROXY_HTTP_IN_DATA_401_ERR, RPC_PROXY_INVALID_RPC_PORT_ERR, RPC_PROXY_RPC_OUT_DATA_404_ERR |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- The tool primarily makes queries and authentication attempts. Frequent runs can affect audit logs, account lockouts, and target load.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
disconnect()is part of cleanup. Check that new early returns and exception paths still reach it.
When changing the implementation
Section titled “When changing the implementation”The code depends on dcerpc.v5.transport, rpcrt, epm, mgmt, and examples.rpcdatabase. RPCMap keeps transport authentication and RPC authentication as separate states; do not merge them.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/rpcmap.py - CLI:
python examples/rpcmap.py -h - Related test:
tests/SMB_RPC/test_rpch.py - Related test:
tests/SMB_RPC/test_rpcrt.py - Related test:
tests/dcerpc/test_epm.py - Related test:
tests/misc/test_dcerpc_v5_ndr.py