8.2 Windows User & Group Enumeration via SMB & RPC

8.2 Windows User & Group Enumeration via SMB & RPC

During an internal infrastructure assessment, Server Message Block (SMB) and Microsoft Remote Procedure Call (MSRPC) represent primary attack surfaces for network enumeration. Before attempting credential attacks or vulnerability exploitation, a penetration tester must enumerate domain and local user accounts, group memberships, file shares, and password policies. Understanding the network transport layers, session establishment mechanics, and RPC interface architectures allows practitioners to extract actionable intelligence from misconfigured or legacy Windows systems.

---

Server Message Block (SMB) & NetBIOS Architecture

Server Message Block is a client-server application-layer protocol used for sharing files, printers, serial ports, and inter-process communication (named pipes) across a local network.

+-----------------------------------------------------------------------------+
|                        SMB NETWORK TRANSPORT LAYERS                         |
+-----------------------------------------------------------------------------+
|  1. Legacy NetBIOS over TCP/IP (NBT) Transport Architecture:                |
|     [UDP 137: NetBIOS Name Service (NBNS) - Name Registration / Resolution] |
|     [UDP 138: NetBIOS Datagram Service - Mailslots / Browser Broadcasts]    |
|     [TCP 139: NetBIOS Session Service - SMB Transport over NetBIOS]         |
|                                                                             |
|  2. Modern Direct-Hosted SMB Transport Architecture (Windows 2000+):        |
|     [TCP 445: Direct-Hosted SMB over TCP/IP (Bypasses NetBIOS Entirely)]    |
+-----------------------------------------------------------------------------+

1. NetBIOS over TCP/IP (NBT)

In early Windows networking (Windows NT, Windows for Workgroups), SMB could not operate directly over raw IP sockets; it required the NetBIOS (Network Basic Input/Output System) framing layer defined in RFC 1001 and RFC 1002. NetBIOS over TCP/IP divides network operations into three specific ports:

• UDP Port 137 (NetBIOS Name Service / NBNS): Resolves 16-character NetBIOS computer and workgroup names to IP addresses. The 16th byte indicates the service type (e.g., <00> for Workstation Service, <20> for File Server, <1B> for Domain Master Browser).
• UDP Port 138 (NetBIOS Datagram Service): Connectionless messaging service used for network browser elections and broadcast announcements.
• TCP Port 139 (NetBIOS Session Service): Connection-oriented transport that provides reliable session handling. Legacy SMB frames were encapsulated inside NetBIOS Session Service packets.

2. Direct-Hosted SMB (TCP Port 445)

Introduced with Windows 2000, direct-hosted SMB operates natively over TCP port 445 without the intermediate NetBIOS session layer. Direct-hosted SMB offers significant security and operational benefits:

• Eliminates the chatty broadcast traffic inherent to NetBIOS name resolution.
• Bypasses NetBIOS limitations on computer name lengths.
• Simplifies firewall traversal and network routing.

3. SMB Protocol Dialect Evolution & Security Features

Key Concept: Pre-Authentication Integrity Introduced in SMB 3.1.1, pre-authentication integrity utilizes SHA-512 cryptographic hashing to verify the integrity of early negotiation and session setup messages before authentication occurs. This prevents an inline adversary from executing a man-in-the-middle attack to tamper with the dialect negotiation and force the endpoints to downgrade to an insecure SMB dialect.

---

SMB Null Sessions (IPC$) & Anonymous Enumeration

What is an SMB Null Session?

An SMB Null Session is an unauthenticated session established to a target Windows system by supplying an empty username ('') and an empty password (''). Null sessions connect specifically to the hidden IPC$ (Inter-Process Communication) share. The IPC$ share does not provide access to the filesystem; rather, it provides a network transport pipeline for named pipes, allowing remote clients to communicate directly with Windows MSRPC services.

# Establishing an SMB Null Session using Windows command prompt
net use \\192.168.1.50\IPC$ '' /u:''

# Establishing a Null Session using Linux smbclient
smbclient -N -L //192.168.1.50

      CLIENT                                               SERVER
         |                                                    |
         |--- SMB Negotiate Protocol Request (SMB dialects) ->|
         |<-- SMB Negotiate Protocol Response (Dialect chosen)-|
         |                                                    |
         |--- Session Setup Request: User='', Pass='' ------->|
         |<-- Session Setup Response: Success (Guest/Null) ---| (Session Created)
         |                                                    |
         |--- Tree Connect Request: Share='\\target\IPC$' --->|
         |<-- Tree Connect Response: Success (Tree ID) -------| (IPC$ Accessible)

Registry Hardening: RestrictAnonymous

The capability of an anonymous or null session to query directory information is governed by the Windows registry key located at: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous

• RestrictAnonymous = 0 (Permissive): Unrestricted anonymous enumeration. Any client connected via a null session can enumerate local/domain user accounts, security groups, and shares. This was the default setting in Windows NT 4.0 and early Windows 2000 installations.
• RestrictAnonymous = 1 (Standard Restriction): Restricts the enumeration of SAM accounts and shares. A null session can still bind to the IPC$ share and query general system information, but high-level user and group enumeration via SAMR is blocked.
• RestrictAnonymous = 2 (Strict Lockdown): Complete restriction of anonymous access. The target operating system refuses any null session connection to the IPC$ share unless explicitly authorized. This is the default setting on modern Windows Server systems and Domain Controllers.

Information Disclosed via Accessible Null Sessions

When a target host permits null session access, a security analyst can extract critical intelligence:

1. Domain Password Policy: Minimum password length, password history length, account lockout threshold (failed attempts before lockout), lockout duration, and observation window.
2. Network Shares: Built-in administrative shares (ADMIN$, C$, IPC$) and custom enterprise file shares, including access permissions.
3. Domain SIDs: The fundamental Security Identifier of the target domain, which is required for RID cycling attacks.
4. User & Group Inventories: Valid usernames, service accounts, and group memberships.

---

Microsoft Remote Procedure Call (MSRPC) Architecture

MSRPC is Microsoft's implementation of the Distributed Computing Environment / Remote Procedure Call (DCE/RPC) standard. It allows program subroutines to execute transparently on remote systems across the network.

+-----------------------------------------------------------------------------+
|                          MSRPC SERVICE DISCOVERY                            |
+-----------------------------------------------------------------------------+
| 1. Client connects to RPC Endpoint Mapper on TCP Port 135                   |
| 2. Client queries for Interface UUID (e.g., SAMR, LSARPC, SRVSVC)           |
| 3. Endpoint Mapper replies with binding: Named Pipe or Dynamic Port         |
| 4. Client communicates directly with the service interface:                |
|                                                                             |
|    [Over SMB Port 445 via Named Pipe]  OR  [Over Dynamic TCP Port (49152+)] |
|       \pipe\samr                             Direct RPC High Port Socket    |
+-----------------------------------------------------------------------------+

The RPC Endpoint Mapper (TCP Port 135)

The RPC Endpoint Mapper (EPMAP) acts as a directory service for RPC applications on a Windows host. Because many RPC server interfaces bind to dynamic, ephemeral high ports (traditionally TCP 1024-5000, and TCP 49152-65535 in Windows Server 2008 and later), clients cannot know which port is hosting a service in advance.

• The client connects to the Endpoint Mapper on TCP port 135.
• The client presents the Universally Unique Identifier (UUID) and version number of the desired interface.
• The Endpoint Mapper looks up its internal registry and returns the dynamic TCP port or the SMB named pipe where the interface is currently listening.

Tools such as Impacket's rpcdump.py interrogate port 135 to enumerate all registered RPC endpoints, exposing installed software, hypervisors, management agents, and database listeners.

Core Windows RPC Interfaces

Several critical Windows administrative interfaces are accessed via MSRPC over named pipes across SMB:

1. SAMR (Security Account Manager Remote):
   • UUID: 12345778-1234-ABCD-EF00-0123456789AC (Named pipe: \pipe\samr)
   • Used for managing and querying the local SAM database and Active Directory domain accounts. Facilitates user, group, and alias enumeration.
2. LSARPC (Local Security Authority RPC):
   • UUID: 12345778-1234-ABCD-EF00-0123456789AB (Named pipe: \pipe\lsarpc)
   • Provides access to security policy interrogation, user rights assignments, domain trust queries, and bidirectional name-to-SID translations.
3. SRVSVC (Server Service):
   • UUID: 4B324FC8-1670-01D3-1278-5A47BF6EE188 (Named pipe: \pipe\srvsvc)
   • Manages network file shares and active client sessions (NetShareEnum, NetSessionEnum).
4. Netlogon:
   • UUID: 12345678-1234-ABCD-EF00-01234567CFFB (Named pipe: \pipe\netlogon)
   • Maintains the secure channel between Domain Controllers and domain workstations, handling logon requests and password synchronization.

---

MSRPC Enumeration Workflows & Tools

1. Interactive Enumeration with rpcclient

rpcclient is a command-line tool from the Samba suite that allows security analysts to bind to MSRPC interfaces and execute native administrative queries.

# Connect to target via SMB Null Session
rpcclient -U '' -N 192.168.1.50

# Or connect using valid low-privileged user credentials
rpcclient -U 'corp.internal\jdoe%Password123' 192.168.1.50

High-Value rpcclient Commands:

• getdompwinfo: Interrogates the domain password policy (returns min password length, password history, and password properties).
• enumdomusers: Enumerates all domain users and their associated Relative Identifiers (RIDs).
• enumdomgroups: Enumerates all domain security groups and their RIDs.
• queryuser <RID>: Queries detailed account metadata for a specific user RID (returns bad password count, logon count, account flags, password last set timestamp, home directory, and user comment/description).
• querygroup <RID> / querygroupmem <RID>: Inspects security group properties and returns the RIDs of all member accounts.
• lookupnames <username>: Resolves an ASCII username to its unique Security Identifier (SID).
• lookupsids <SID>: Resolves a SID to its corresponding domain and account name.

rpcclient $> getdompwinfo
min_password_len: 12
password_properties: 0x00000001 (DOMAIN_PASSWORD_COMPLEX)

rpcclient $> queryuser 0x1f4
        User Name   : Administrator
        Full Name   : Built-in account for administering the computer/domain
        Home Drive  : 
        Logon Script: 
        Profile Path: 
        Account Flags: [ACB_NORMAL]
        Logon Hours : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
        Bad Pwd Count: 0
        Logon Count : 42

2. Automated Enumeration Suites

• enum4linux / enum4linux-ng: Automates the complete enumeration workflow (null session verification, share listing, password policy dumping, user harvesting via SAMR, and RID cycling).
• NetExec (nxc, formerly CrackMapExec): Rapidly probes SMB endpoints for null session access, user enumeration, and share permissions:

  # Test for anonymous share and user enumeration
  nxc smb 192.168.1.0/24 -u '' -p '' --shares --users --pass-pol
  

---

Relative Identifier (RID) Cycling Mechanics

When a Windows system is hardened with RestrictAnonymous = 1, broad listing commands like enumdomusers fail because the operating system denies bulk queries through the SAMR interface. However, security analysts can circumvent this restriction using Relative Identifier (RID) Cycling.

+-----------------------------------------------------------------------------+
|                        STRUCTURE OF A WINDOWS SID                           |
+-----------------------------------------------------------------------------+
|  S - 1 - 5 - 21 - 3623811015 - 3361044348 - 30300820 - 500                  |
|  |   |   |   |   |---------------------------------|   |                    |
|  |   |   |   |            Sub-Authorities              |                    |
|  |   |   |   |       (Unique to this Domain)           |                    |
|  |   |   |   +-- Domain Identifier                     |                    |
|  |   |   +------ NT Authority Identifier               |                    |
|  |   +---------- Revision Level                        |                    |
|  +-------------- SID Prefix                            +-- RID (500 = Admin)|
+-----------------------------------------------------------------------------+

Well-Known Relative Identifiers (RIDs)

Every Windows account, group, and computer object is assigned a Security Identifier (SID). The final numerical segment of the SID is the Relative Identifier (RID). Microsoft assigns fixed, deterministic RIDs to standard built-in accounts:

The RID Cycling Methodology

1. Acquire Base Domain SID: The analyst extracts the domain's base SID (e.g., S-1-5-21-3623811015-3361044348-30300820) via a null session, an unauthenticated LSARPC query, or an authenticated lookup of any single known account.
2. Sequential Probing: Rather than requesting a full user list, the testing tool constructs individual SIDs by appending sequential RID numbers to the base SID (BaseSID + 500, BaseSID + 501, BaseSID + 1000, BaseSID + 1001, ...).
3. MSRPC Query Execution: The tool submits single-SID lookup requests to the LSARPC function LsarLookupSids or SAMR function SamrOpenUser.
4. Bypass Advantage: Windows access control checks for individual SID-to-name translations are significantly more permissive than bulk listing queries. Even when user lists are blocked, the server responds to each valid query with the corresponding account name.
5. Renamed Administrator Discovery: Renaming the built-in Administrator account (e.g., to SuperUser or LocalAdmin) is a common hardening measure. However, renaming an account does not alter its RID. By querying RID 500, RID cycling immediately discovers the new, renamed administrator account.