> For the complete documentation index, see [llms.txt](https://playbook.sidthoviti.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://playbook.sidthoviti.com/network-pentesting/port-service-enumeration/135-593-msrpc.md).

# 135, 593 MSRPC

#### RPCdump (Impacket)

The command queries RPC locator service and individual RPC endpoints to catalog services running over TCP, UDP, HTTP, and SMB (via named pipes).

Each returned IFID value represents an RPC service.

```
impacket-rpcdump -p 135 IP
```

Check for **Printer Nightmare** vulnerability:

Impacket's `rpcdump.py` can be used to check for `MS-PAR` and `MS-RPRN` protocols:

```
impacket-rpcdump -p 135 IP | grep -E "MS-RPRN|MS-PAR"
```

#### Nmap

```
nmap -sV -script msrpc-enum -Pn $IP
```

#### RPC Client

Interact with individual RPC endpoints via named pipes. Check for Null Session access to SMB. If null session is not allowed, then username and password must be provided.

```
rpcclient -U "" -N 10.0.0.3
```