RPC

#Go to LDAP\AD\DC > Impacket first

#Msfconsole

Search dcerpc

use auxiliary/scanner/dcerpc/endpoint_mapper

use auxiliary/scanner/dcerpc/hidden

#Impacket

rpcmap.py 'ncanc_ip_tcp:10.0.0.1'

#help

rpcmap.py 'ncanc_ip_tcp:10.0.0.1' -h

rpcmap.py 'ncanc_ip_tcp:10.0.0.1' -brute_uuids -brute_opnums -auth-level 1 -opnum-max 10 (up to 100)

look for success and google UUID's

https://airbus-cyber-security.com/the-oxid-resolver-part-1-remote-enumeration-of-network-interfaces-without-any-authentication/

copy python2 script from site and update

print 'IOXIDResolver.py -t ' <target>'

print ('IOXIDResolver.py -t ' <target>')

execute

python3 IOXIDResolver.py -t 10.0.0.1

set local host for ipv6

nmap -6 -sC -sV -O -v -oA ./htb/apt-ipv6.n