Home > Network Pentesting

RPC & WinRM Attacks

RPC and WinRM attacks target remote management interfaces used heavily in Windows environments. Both services enable administrative communication across the network. When misconfigured, they expose authentication paths, remote execution capabilities, and privilege escalation opportunities. Effective exploitation requires understanding how these services authenticate, what permissions they grant, and how to abuse weak configurations.

Understanding RPC and WinRM Attack Surface

RPC (Remote Procedure Call) and WinRM (Windows Remote Management) support:

  • Remote administration

  • Domain communication

  • Service management

  • WMI queries

  • PowerShell remoting

Common weaknesses include:

  • Weak authentication

  • NTLM relay possibilities

  • Unrestricted remote execution

  • Misconfigured permissions

  • Exposure of sensitive system information

Enumeration reveals available services, authentication behavior, and access control details.

RPC Enumeration

RPC runs on multiple dynamic ports and communicates with many Windows services. Pentesters focus on identifying accessible RPC endpoints and extracting domain or system information.

Checking RPC Open Ports

nmap -sV -p135 10.10.10.5

Port 135 exposes the RPC Endpoint Mapper, which lists available RPC services.

Enumerating RPC Endpoints

rpcdump.py 10.10.10.5

This reveals:

  • Available services

  • UUIDs

  • Bound pipes

  • System functions

These endpoints support deeper enumeration or privilege escalation paths.

Using rpcclient for Anonymous or Authenticated Access

rpcclient -U "" -N 10.10.10.5

If null sessions are allowed, attackers may enumerate:

  • Users

  • Groups

  • Password policy

  • Domain SID

Common commands:

enumdomusers
enumdomgroups
getdompwinfo
lsaquery
lookupnames user

Anonymous RPC access is a critical misconfiguration.

RPC Exploitation Techniques

RPC can expose sensitive domain information or allow privilege escalation.

Bruteforcing Users via RPC

rpcclient -U "" 10.10.10.5
queryuser username

If the server responds differently for valid users, user enumeration becomes possible.

Abuse of Named Pipes

Some RPC pipes allow privileged operations:

  • samr

  • lsarpc

  • netlogon

  • wkssvc

If accessible, attackers extract:

  • Domain SIDs

  • User lists

  • Group memberships

These details directly support credential attacks.

WinRM Enumeration

WinRM listens on:

  • HTTP: port 5985

  • HTTPS: port 5986

It provides PowerShell remoting and remote command execution when authenticated. Enumeration identifies authentication methods and checks if WinRM is enabled for specific users.

Checking WinRM Availability

nmap -p5985,5986 10.10.10.5

Testing WinRM Authentication

crackmapexec winrm 10.10.10.5 -u users.txt -p passwords.txt

Valid credentials indicate potential remote execution.

Testing a Single Credential

crackmapexec winrm 10.10.10.5 -u admin -p Pass123

If success, WinRM access is granted.

WinRM Exploitation

After identifying valid credentials, WinRM provides remote execution with PowerShell.

Remote Shell Access

evil-winrm -i 10.10.10.5 -u admin -p Pass123

This opens an interactive PowerShell session, often with administrative privileges.

Using NTLM Hashes (Pass-the-Hash)

evil-winrm -i 10.10.10.5 -u admin -H <hash>

WinRM accepts NTLM hashes under many configurations, enabling access without cracking passwords.

Running Remote Commands

Invoke-Command -ComputerName 10.10.10.5 -ScriptBlock { whoami }

Pentesters use this for:

  • System discovery

  • Credential extraction

  • Lateral movement

WinRM is one of the most powerful lateral movement vectors in Windows networks.

Exploiting Misconfigurations

Common RPC and WinRM weaknesses include:

  • NTLM relay enabled

  • WinRM enabled for low-privilege users

  • Domain accounts with remote execution permissions

  • Weak passwords

  • Password reuse across services

  • Disabled encryption

  • Users with compromised SPNs

Pentesters identify these during enumeration and exploit them for remote access.

NTLM Relay Against RPC and WinRM

If SMB signing is not required and NTLM is allowed, NTLM relay enables attackers to authenticate as victims.

Checking SMB Signing

nmap --script smb-security-mode -p445 10.10.10.5

If signing is not required, relay attacks may be possible.

Attackers relay captured NTLM hashes to WinRM:

ntlmrelayx.py -t winrm://10.10.10.5

Successful relay grants a remote PowerShell session.

Post-Exploitation via RPC and WinRM

Once access is gained, pentesters enumerate:

  • Privileges

  • Active sessions

  • Domain membership

  • Installed software

  • Credential material

Tools used:

  • mimikatz

  • BloodHound/SharpHound

  • PowerView

  • System utilities

RPC and WinRM exploitation often leads to full domain compromise if privilege escalation paths exist.

Why RPC & WinRM Attacks Matter

RPC and WinRM provide powerful remote administration capabilities. When misconfigured, they expose:

  • User lists

  • Domain structure

  • Remote command execution

  • Lateral movement paths

  • Credential theft opportunities

Exploitation often leads to full system or domain compromise, making RPC and WinRM critical focus areas in Windows network pentesting.

Intel Dump

  • RPC exposes domain info, users, groups, and system data

  • WinRM provides remote PowerShell execution

  • CrackMapExec and evil-winrm are key exploitation tools

  • Misconfigurations allow NTLM relay, pass-the-hash, and remote execution

  • RPC/WinRM compromise often leads to full privilege escalation and lateral movement

HOME LEARN COMMUNITY DASHBOARD