rpcdump.py
Dump remote RPC endpoints information via the Endpoint Mapper. tldr-pages
On several platforms
Several platforms
Dump remote RPC endpoints information via the Endpoint Mapper. Part of the Impacket suite.
Dump RPC endpoints using username and password
rpcdump.py domain/username:password@targetIdentifyDump RPC endpoints using NTLM hashes
rpcdump.py -hashes LMHASH:NTHASH domain/username:password@targetIdentifySpecify a target IP address explicitly (useful if the target name is a NetBIOS name)
rpcdump.py -target-ip target_ip domain/username:password@targetIdentifyConnect to a specific port (default is 135 for RPC Endpoint Mapper)
rpcdump.py -port port_number domain/username:password@targetIdentifyEnable debug output
rpcdump.py -debug domain/username:password@targetIdentify