SMB Enumeration with rpcclient

Connects to a target over MS-RPC with a null session and enumerates domain users via querydispinfo.

Use rpcclient to enumerate users, groups, and other domain information over MS-RPC, often via a null/anonymous session.

Steps

• Connect with a null session using -U "" and -N (no password) to the target IP.
• Once in the rpcclient prompt, run querydispinfo to list domain users and descriptions.