rpcclient

using rpcclient we can get or enumerate user list in the AD: tried with 1st and 2nd option but it did not work. once we get support user password then it worked. 

rpcclient 10.10.10.192  (hit enter for blank password)

or

rpcclient 10.10.10.192 -U ' '  (null authentication, hit enter for blank password)

you will get enter but enumdomusers command will not work. 

rpcclient -U support 10.10.10.192 (once give enter it will ask for support user password)

rpcclient $> enumdomusers

Once we have valid one domain users username and password then we can leverage rpcclient to enumerate domain users. 

see here, along with users we get users rid. this rid will help to find out users members of how many groups and what are those groups.

for example, you want to find out svc-alfresco in how many groups? so note down his rid.

rpcclient $> queryusergroups 0x47b

this will show a list of group rid that the user member of.

now:

rpcclient $> querygroup 0x201

rpcclient $> queryuser 0x47b

  

--------------------------------------------------------------

we can also change users password using rpcclient. but still we need a domain user credentials to get into rpcclient to do that. lets assume we are inside of rpcclient

rpcclient $> setuserinfo2 Audit2020 23 'PleaseSub!'

Audit2020 is the user whose password we are going to change. 

23 = user information class = user internal 4 information

password = 'PleaseSub!' 

Avi