rpcclient is a command-line utility that is part of the Samba suite of tools. It is used to interact with Microsoft’s Remote Procedure Call (RPC) protocol, which is used for communication between Windows-based systems and other devices. rpcclient is primarily used for debugging and testing purposes, and can be used to query and manipulate remote systems.
Here are some of the main features of rpcclient:
- MS-RPC client: rpcclient is a client for the MS-RPC protocol, which is used for communication between Windows-based systems and other devices. It allows users to interact with remote systems using the RPC protocol.
- Testing and debugging: rpcclient is primarily used for testing and debugging purposes. It can be used to query remote systems for information, as well as to manipulate remote systems.
- Scripting: rpcclient can be used in scripts to automate common tasks, such as querying remote systems for information or performing specific actions.
- Authentication: rpcclient supports a variety of authentication mechanisms, including NTLM, Kerberos, and plain-text authentication.
If you encounter the below error while running the command rpcclient:
rpcclient: command not found
you may try installing the below package as per your choice of distribution:
| Distribution | Command |
|---|---|
| Debian | apt-get install smbclient |
| Ubuntu | apt-get install smbclient |
| Arch Linux | pacman -S smbclient |
| Kali Linux | apt-get install smbclient |
| CentOS | yum install samba4-client |
| Fedora | dnf install samba-client-2 |
| Raspbian | apt-get install smbclient |
rpcclient Command Examples
1. Connect to a remote host:
# rpcclient --user domain\username%password ip
2. Connect to a remote host on a domain without a password:
# rpcclient --user username --workgroup domain --no-pass ip
3. Connect to a remote host, passing the password hash:
# rpcclient --user domain\username --pw-nt-hash ip
4. Execute shell commands on a remote host:
# rpcclient --user domain\username%password --command semicolon_separated_commands ip
5. Display domain users:
# rpcclient $> enumdomusers
6. Display privileges:
# rpcclient $> enumprivs
7. Display information about a specific user:
# rpcclient $> queryuser username|rid
8. Create a new user in the domain:
# rpcclient $> createdomuser username
Summary
Overall, rpcclient is a useful tool for system administrators and developers who need to interact with Windows-based systems using the RPC protocol. Its ability to query and manipulate remote systems, combined with its support for scripting and authentication, make it a versatile tool that can be used in a variety of applications.