> For the complete documentation index, see [llms.txt](https://tenaka.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tenaka.gitbook.io/pentesting/enumeration/ldap-ad-dc/rpc.md).

# RPC

#### #Go to LDAP\AD\DC > Impacket first

#### #Msfconsole

Search dcerpc

use auxiliary/scanner/dcerpc/endpoint\_mapper

use auxiliary/scanner/dcerpc/hidden

#### #Impacket

rpcmap.py 'ncanc\_*ip*\_tcp:10.0.0.1' 

#### #help

rpcmap.py 'ncanc\_*ip*\_tcp:10.0.0.1' -h

rpcmap.py 'ncanc\_*ip\_tcp:10.0.0.1'  -brute\_uuids -brute\_opnums -auth-level 1 -opnum-max 10   (up to 100)*

*look for success and google UUID's*

<https://airbus-cyber-security.com/the-oxid-resolver-part-1-remote-enumeration-of-network-interfaces-without-any-authentication/>

*copy python2 script from site and update*

print 'IOXIDResolver.py -t ' \<target>'

print ***(***'IOXIDResolver.py -t ' \<target>'**)**

#### execute

python3 IOXIDResolver.py -t 10.0.0.1

set local host for ipv6

nmap -6 -sC -sV -O -v -oA ./htb/apt-ipv6.n