dcerpc

Overview ¶

Package dcerpc decodes DCE/RPC (Distributed Computing Environment / Remote Procedure Call) messages per DCE 1.1 + [MS-RPCE] — the Microsoft RPC framing layer that carries nearly every Windows AD attack chain. Runs over TCP/135 (Endpoint Mapper), TCP/49152+ (ephemeral RPC ports), and inside SMB2 named pipes (\pipe\netlogon, \pipe\samr, \pipe\lsarpc, \pipe\srvsvc, \pipe\svcctl, \pipe\drsuapi, \pipe\spoolss).

Operationally, DCE/RPC is the **MS-RPC attack-vector identifier**. SMB2 surfaces `\pipe\<name>` paths; DCE/RPC surfaces the underlying interface UUID + opnum that identify the exact RPC function being invoked. The combination is the canonical attack-chain indicator. Each well-known interface UUID maps to a Microsoft Windows service:

• **NETLOGON** (`12345678-1234-abcd-ef00-01234567cffb`) — opnum 30 (`NetrServerAuthenticate3`) is the **ZeroLogon** target (CVE-2020-1472). Observing BIND to the netlogon UUID + REQUEST opnum 30 is the canonical ZeroLogon attack signature.

• **DRSUAPI** (`e3514235-4b06-11d1-ab04-00c04fc2dcd2`) — opnum 3 (`DRSGetNCChanges`) is the **DCSync** attack vector. The Directory Replication Service primitive used by `lsadump::dcsync` (mimikatz) and `impacket secretsdump.py -just-dc` to extract all AD password hashes by impersonating a DC replication partner. **High-privilege requirement** (Replicating Directory Changes All) — but a single compromised admin account yields every domain hash.

• **SAMR** (`12345778-1234-abcd-ef00-0123456789ab`) — the Security Account Manager Remote interface, used for **AD user / group enumeration** (`net user /domain`, `enum4linux`, `rpcclient enumdomusers`). High-runner opnums: 5 `SamrOpenDomain` / 13 `SamrEnumerateUsersIn Domain` / 27 `SamrLookupNamesInDomain` / 36 `SamrQueryInformationUser` (per-user attribute leak — description, badPwdCount, lastLogon).

• **LSARPC** (`12345778-1234-abcd-ef00-0123456789ac`) — Local Security Authority remote interface, used for SID translation + LSA-policy access + **SAM secrets dump** (`lsadump::secrets`, `lsadump::trust`).

• **SVCCTL** (`367abb81-9844-35f1-ad32-98f038001003`) — Service Control Manager remote interface, used by **PsExec / impacket psexec.py / smbexec.py** for lateral-movement service creation + start (opnums: 12 `RCreateServiceW` / 19 `RStartServiceW`).

• **SPOOLSS** (`12345678-1234-abcd-ef00-0123456789ab`) — Print Spooler remote interface; opnum 65 `RpcRemoteFindFirstPrinterChangeNotificationEx` is the **PrintNightmare** target (CVE-2021-1675 / CVE-2021-34527) — abused for SYSTEM RCE on print spooler.

• **ATSVC** (`1ff70682-0a51-30e8-076d-740be8cee98b`) — Task Scheduler Service remote interface, alternative lateral-move path when svcctl is restricted (opnums: 0 `NetrJobAdd` / 1 `NetrJobDel`).

• **ITaskSchedulerService** (`86d35949-83c9-4044-b424- db363231fd0c`) — modern XML-task-XML task scheduler interface, schtasks lateral-move target.

• **WKSSVC** (`6bffd098-a112-3610-9833-46c3f87e345a`) — Workstation Service, often abused for `NetWkstaUserEnum` (logged-on users disclosure).

• **SRVSVC** (`4b324fc8-1670-01d3-1278-5a47bf6ee188`) — Server Service, used for `NetSessionEnum` (active SMB sessions enumeration → identifying logged-on admin accounts), `NetShareEnum` (share enumeration).

• **EPMAPPER** (`afa8bd80-7d8a-11c9-bef4-08002b102989`) — Endpoint Mapper on TCP/135; bind to look up which ephemeral TCP port a target interface is exposed on (the RPC `portmap`).

Wrap-vs-native judgement

Native. DCE 1.1 + [MS-RPCE] are publicly documented; the
common header is a fixed 16-byte struct. Data
representation is byte-order-flagged via drep[0] (bit 4
= little-endian; Windows is always LE on the wire).
BIND / REQUEST / FAULT body decoding is straightforward.
The sec_trailer (auth_type / auth_level + NTLMSSP
auth_value) is parsed in place; NDR parameter marshalling,
IDL interface inner-decode, and DCOM ORPCTHIS chains are
out of scope.

What this package covers

• **16-byte common header** ([MS-RPCE] §2.2.6.1): rpc_vers (1) = 5 / rpc_vers_minor (1) = 0 / PTYPE (1) / pfc_flags (1) / drep[4] (data representation; drep[0] bit 4 = little-endian) / frag_length (2) / auth_length (2) / call_id (4).

• **14-entry PTYPE name table** (RFC 2237 / DCE 1.1 §12.1): 0 `REQUEST` / 1 `PING` / 2 `RESPONSE` / 3 `FAULT` / 4 `WORKING` / 5 `NOCALL` / 6 `REJECT` / 7 `ACK` / 8 `CL_CANCEL` / 9 `FACK` / 10 `CANCEL_ACK` / 11 `BIND` / 12 `BIND_ACK` / 13 `BIND_NAK` / 14 `ALTER_CONTEXT` / 15 `ALTER_CONTEXT_RESP` / 16 `SHUTDOWN` / 17 `CO_CANCEL` / 18 `ORPHANED` / 19 `AUTH3`.

• **6-entry pfc_flags name table**: 0x01 `FIRST_FRAG` / 0x02 `LAST_FRAG` / 0x04 `PENDING_CANCEL` / 0x10 `CONC_MPX` / 0x20 `DID_NOT_EXECUTE` / 0x80 `OBJECT_UUID`.

• **BIND / ALTER_CONTEXT body walker** ([MS-RPCE] §2.2.6.4): max_xmit_frag (2) / max_recv_frag (2) / assoc_group_id (4) / p_context_elem_count (1) / reserved (3) / p_context_elem[]. The first context element carries the abstract_syntax (interface UUID

• interface version) — the canonical RPC interface identifier.

• **20+ entry interface UUID name table** flagging each well-known interface with its canonical attack vector (netlogon ZeroLogon, drsuapi DCSync, samr AD enum, spoolss PrintNightmare, svcctl PsExec, atsvc Task Scheduler lateral move, lsarpc SAM secrets dump, srvsvc NetSessionEnum, wkssvc NetWkstaUserEnum, epmapper Endpoint Mapper, DnsServer, IRemoteWinspool, ITaskSchedulerService, IFileReplicaService, IFlightServer).

• **REQUEST body walker** ([MS-RPCE] §2.2.6.2): alloc_hint (4) / p_cont_id (2) / opnum (2) — the function within the interface being called. Combined with the interface UUID, opnum is the exact RPC function identifier.

• **FAULT body walker** ([MS-RPCE] §2.2.6.6): alloc_hint (4) / p_cont_id (2) / cancel_count (1) / reserved (1) / status (4) — DCE RPC fault status code. Surfaced with a fault-status name table covering high-runner DCE RPC + MS-RPC NCA fault codes.

• **9-entry NCA fault status name table** (DCE 1.1 §12.6.4.10 + MS-RPCE §3.1.1.5.5): 0x00000005 `nca_s_fault_access_denied` / 0x1C010002 `nca_s_fault _addr_error` / 0x1C010003 `nca_s_fault_context_mismatch` / 0x1C00000B `nca_s_fault_out_of_resources` / 0x1C00000C `nca_s_fault_unspec_reject` / 0x1C010014 `nca_s_fault_invalid_pres_context_id` / 0x1C010015 `nca_s_fault_unsupported_type` / 0x6BD `RPC_X_BAD_STUB _DATA` / 0x6F7 `RPC_S_SERVER_UNAVAILABLE`.

• **sec_trailer authentication trailer** ([MS-RPCE] §2.2.2.11) — when auth_length > 0 the last `auth_length + 8` bytes are the 8-byte sec_trailer header (auth_type / auth_level / pad_length / reserved / auth_context_id) followed by the auth_value token. auth_type is named (NTLMSSP / SPNEGO / Kerberos / NETLOGON / Schannel). When the auth_value carries an NTLMSSP message — located by the 8-byte `NTLMSSP\0` signature, so SPNEGO-wrapped blobs are handled too — it is **decoded in place** as `ntlm_message` (the NTLM-over-RPC relay / Pass-the-Hash capture path; the drsuapi / netlogon CHALLENGE carries the server challenge + target-info AV pairs). A Kerberos auth_value (no NTLMSSP signature) is left for kerberos_decode.

What this package does NOT cover (deliberately out of scope)

• **NDR (Network Data Representation) parameter marshalling** — each per-interface IDL function takes typed parameters marshalled via NDR (the DCE 1.1 transfer syntax). The decoder surfaces the opnum but does NOT decode the parameters; that requires the full IDL definition for each interface (1000+ Microsoft RPC interfaces).
• **DCOM (Distributed COM) ORPCTHIS / ORPCTHAT** — wraps an extra header onto DCE/RPC requests for the OXID/OID/IPID DCOM addressing layer; out of scope.
• **Connectionless DCE/RPC** (UDP/135) — the decoder focuses on connection-oriented DCE/RPC (TCP); the CL variant uses different PTYPE values and is rarely seen in modern Windows AD environments.
• **Kerberos / Schannel auth_value bodies** — a non-NTLMSSP auth_value (Kerberos AP-REQ, Schannel TLS record) surfaces auth_type / auth_level but its token body is left for kerberos_decode; only the NTLMSSP mechanism is decoded in place.
• **Interface-specific opnum name tables** — the decoder surfaces the raw opnum integer; per-interface opnum-to-function name mapping (netlogon opnum 30 = NetrServerAuthenticate3, drsuapi opnum 3 = DRSGetNCChanges) is out of scope (each interface has 30+ opnums and there are 1000+ interfaces).