> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.krkn.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# RPC

# rpc

RPC (Remote Procedure Call) enumeration and endpoint discovery. R4t uses null sessions and authenticated RPC to enumerate users, groups, trusts, machines, printers, and endpoint bindings.

***

## Usage

```text theme={null}
r4t rpc <subcommand> [flags]
```

***

## Subcommands

### `rpc get`

Enumerate AD and host information via RPC protocols.

```text theme={null}
r4t rpc get <type> [flags]
```

Each subtype supports the same output flag:

| Flag       | Short | Description           |
| ---------- | ----- | --------------------- |
| `--output` | `-o`  | Write results to file |

#### Types

| Type          | Description                                  |
| ------------- | -------------------------------------------- |
| `user`        | Enumerate user accounts via RPC (SAM / SAMR) |
| `group`       | Enumerate local and domain groups via RPC    |
| `trust`       | Enumerate domain trusts via RPC (LSARPC)     |
| `machine`     | Enumerate machine accounts via RPC           |
| `printer`     | Enumerate printers via MS-RPRN               |
| `desc`        | Enumerate user description fields via RPC    |
| `permissions` | Enumerate RPC endpoint permissions           |

#### Examples

```bash theme={null}
# Enumerate users via RPC (can work with null session on older systems)
r4t rpc get user

# Enumerate groups
r4t rpc get group

# Enumerate domain trusts via LSARPC
r4t rpc get trust

# Enumerate machine accounts
r4t rpc get machine

# Enumerate printers (also identifies PrinterBug / SpoolSample targets)
r4t rpc get printer

# Get user descriptions
r4t rpc get desc

# Check RPC endpoint permissions
r4t rpc get permissions

# Write results to file
r4t rpc get user --output /tmp/rpc-users.txt
```

***

### `rpc dump`

Dump all RPC endpoints registered with the endpoint mapper (port 135).

```bash theme={null}
r4t rpc dump
```

Connects to the target's endpoint mapper and enumerates all registered RPC interfaces, UUIDs, protocols, and binding strings. Useful for identifying what services are running and what attack surface is exposed.

***

## RPC Storage

RPC findings are stored in the database:

| Table             | Contents                                  |
| ----------------- | ----------------------------------------- |
| `rpc_permissions` | Enumerated RPC access rights per endpoint |
| `rpc_sessions`    | Active RPC session tracking               |

***

## Null Session vs Authenticated

RPC enumeration can work via:

* **Null session** (unauthenticated) — use `--anonymous` flag. Works against legacy or misconfigured systems.
* **Authenticated** — uses stored or inline credentials via global flags.

```bash theme={null}
# Null session attempt
r4t rpc get user --anonymous

# Authenticated
r4t rpc get user -u jsmith -p 'P@ssword1' -d corp.example.com
```