# rpcclient

```
rpcclient -U "" 10.129.14.128

rpcclient -U'%' 10.10.110.17
```

<pre data-overflow="wrap"><code><strong># Commands
</strong>enumdomusers

<strong># Just see the 0x info from enumdomusers
</strong>queryuser &#x3C;RID>	
queryuser 0x3e9 
querygroup 0x201

<strong># Will return the username,user_rid,group_rid    
</strong>for i in $(seq 500 1100);do rpcclient -N -U "" 10.129.14.128 -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" &#x26;&#x26; echo "";done
</code></pre>

```
srvinfo
```

```
enumdomains
```

```
querydominfo
```

```
netshareenumall
```

```
netsharegetinfo <share>	
```

```
# This will display the usernames
enumdomusers
```

{% code overflow="wrap" %}
```
for u in $(cat valid_users.txt);do rpcclient -U "$u%Welcome1" -c "getusername;quit" 172.16.5.5 | grep Authority; done
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fvg2pPQabdiIpiLm0DJqc%2Fimage.png?alt=media&#x26;token=e985be63-2c29-47ad-94c1-3bd98b614ae6" alt=""><figcaption></figcaption></figure>
