M04-11 · RPC enumeration

October 26 evening: one core concept at a time

1. What is RPC?

RPC (Remote Procedure Call) lets a program send parameters to another process, ask it to execute a particular function, and receive the result.

Think of calling a public office: the task you want performed is a procedure, the unit providing it is a service, and directory assistance tells you which extension to call. Knowing the extension does not authorize every transaction.

The client initiates a call and the server processes it. These roles depend on the interaction; they are not permanent identities of computers. RPC is a category of communication mechanisms, so not all RPC implementations use the same protocol. RFC 5531

2. What does enumeration discover?

Some service endpoints are assigned dynamically, so mapping services help locate them. RPC enumeration organizes which services or interfaces exist, their versions and transports, and the endpoints where they are registered.

These clues support authorized asset inventories, information-disclosure reviews, and connection troubleshooting. Confirm the target, source, and permitted scope before querying; even read-only activity may generate logs or load.

An interface describes available operations; an endpoint identifies where to reach a service. Endpoints may be network ports or other forms, so they are not always TCP port numbers.

3. Ports 111 and 135 serve different mapping systems

ONC RPC:

• A program number identifies a service.
• A version identifies the service protocol version.
• A procedure number identifies the function to call.
• Over TCP/UDP, rpcbind/portmapper uses port 111 for lookup; actual services may use other endpoints.

This version is not a software product version and cannot directly establish a particular vulnerability. RFC 1833

Microsoft RPC:

A common TCP scenario queries the Endpoint Mapper on port 135, then connects to the corresponding service endpoint, which may be a dynamic port. Transport over SMB named pipes is also possible.

Seeing port 135 does not establish that all RPC functions have been enumerated, and not every RPC call passes through port 135. ONC RPC's port 111 and Microsoft RPC's port 135 must be distinguished. Microsoft service and port guidance

4. A purely synthetic example

Suppose an authorized laboratory returns this mapping:

Host Lab-A

Program number 536870912

Service protocol version 1

Transport TCP

Endpoint 35001

This establishes only that the retrieved registration maps this service version to TCP 35001 on Lab-A.

The following remain separate questions:

• Can the endpoint be reached from the current network segment?
• Does the service accept this identity?
• May this identity execute a specific function?
• Does that function actually have an exploitable weakness?

A firewall may block the endpoint, and the service may reject authentication or authorization. Knowing the address does not replace this evidence. No real target was queried for this example.

5. Defenses and evidence interpretation

Record registration discovery, endpoint connectivity, successful authentication, and permission to execute a function separately. Preserve the time, source network segment, query identity conditions, and necessary original responses, without secrets or unnecessary personal data.

No mapping does not necessarily mean no service: filtering, permissions, or configuration may restrict visibility. A discovered mapping does not establish data access, a vulnerability, or administrator rights.

Remove unnecessary services, restrict access to trusted sources, and review exposure of both the mapping service and actual endpoints. Do not simply disable core Windows RPC services to close a port.

Quick check:

A service is registered on TCP 35001, but a connection from your current network segment fails. What can you establish, and which conclusions about permissions or vulnerabilities are still unsupported?

Reply in one or two sentences.