Pentesting MSRPC Ports 135 and 593

Pentesting MSRPC

Port 135 hosts the Microsoft RPC Endpoint Mapper, the service Windows uses to hand out the dynamically-assigned ports behind DCOM, WMI and a large number of other RPC-based services. Port 593 exposes the same RPC interfaces tunnelled over HTTP, historically used by Outlook Anywhere against Exchange.

From a pentesting perspective, the Endpoint Mapper is worth querying directly, since the list of registered interfaces reveals exactly what's running on a host, and DCOM/WMI reachable through it are common, low-noise routes to remote command execution once credentials are available. This page covers the Endpoint Mapper itself; named-pipe RPC services like SAMR and LSA are covered on the [111/139 - RPC](/exploitation-of-ports-and-services/port-111-139-334-rpc/) page.

Discovery and Enumeration

1
nmap -sV -p 135,593 --open -T4 -Pn -n 10.1.1.0/24   # Scan a network range for the RPC Endpoint Mapper
2
nmap -sV -sC -p 135 10.1.1.1                        # Service and default script scan against a single host

Enumerating Registered Interfaces

Every service registered with the Endpoint Mapper, DCOM applications, WMI, print services and more, can be listed directly. Impacket’s rpcdump.py queries this without any credentials at all.

1
rpcdump.py @10.1.1.1                    # Dump every interface registered with the Endpoint Mapper
2
rpcdump.py -p 135 10.1.1.1              # Explicitly target port 135
3
rpcdump.py @10.1.1.1 | grep -i mgmt     # Filter for a specific interface by name

The returned UUIDs can be cross-referenced against a known list, such as Microsoft’s published RPC interface UUIDs, to identify exactly which services (DCOM, WMI, print spooler, etc.) are exposed on the host.

Dumping Local Accounts via SAMR

Impacket’s samrdump.py enumerates local users, groups and shares over the SAMR interface, which is registered through the Endpoint Mapper on 135 before the actual session moves to a named pipe over SMB.

1
samrdump.py 10.1.1.1                                     # Anonymous/null session enumeration
2
samrdump.py '<domain>/<username>:<password>@10.1.1.1'    # Authenticated enumeration

DCOM and WMI Command Execution

Once valid credentials are available, DCOM and WMI, both reachable through the Endpoint Mapper, provide quiet alternatives to PsExec-style command execution that don’t touch the Service Control Manager. Impacket ships dedicated tools for both.

1
dcomexec.py '<domain>/<username>:<password>@10.1.1.1'                  # Command execution via DCOM (MMC20.Application by default)
2
dcomexec.py -object ShellWindows '<domain>/<username>:<password>@10.1.1.1'   # Use an alternative DCOM object
3
wmiexec.py '<domain>/<username>:<password>@10.1.1.1'                   # Command execution via WMI (Win32_Process)
4
wmiexec.py -hashes <lm_hash>:<nt_hash> '<domain>/<username>@10.1.1.1'  # Pass-the-hash over WMI

What Should We Look For?

Does the Endpoint Mapper respond to unauthenticated rpcdump.py queries, and does the resulting interface list expose anything unexpected (management interfaces, legacy services)?
Are null-session SAMR queries against samrdump.py still permitted, leaking local account and share information without credentials?
Is DCOM/WMI execution logged and alerted on to the same degree as more familiar lateral movement paths like PsExec?
Is RPC over HTTP (593) still enabled on an Exchange server that no longer needs to support Outlook Anywhere?

135/593 - MSRPC