rpcclient
Query MS-RPC on Windows/Samba hosts.
KaliParrotLinuxlow
pkg: smbclient
rpcclient runs MS-RPC functions to enumerate users, groups, shares and domain info over SMB.
Syntax
rpcclient -U "" {host}
Example
rpcclient -U "" -N 10.0.0.5 -c enumdomusers
Null-session enumerates domain users via RPC.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
rpcclient
Usage examples
rpcclient -U "" -N 10.0.0.5 -c enumdomusers
Enumerate domain users (null session).
rpcclient -U "" -N 10.0.0.5
Interactive RPC session.
Advantages
- Deep AD/SMB enumeration
- Scriptable -c commands
Disadvantages
- Needs null/valid session
- Manual
Tags
#smb#rpc#ad
Official docs: rpcclient ↗
Related commands
Frequently asked questions
What is rpcclient used for?
rpcclient runs MS-RPC functions to enumerate users, groups, shares and domain info over SMB.
What is an example rpcclient command?
A common example is: rpcclient -U "" -N 10.0.0.5 -c enumdomusers — Null-session enumerates domain users via RPC.
Is rpcclient part of Kali Linux?
Yes. rpcclient ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install smbclient.
What category of security tool is rpcclient?
rpcclient is a Information Gathering tool with a low-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.