Crate dcerpc 

A minimal DCE/RPC (MS-RPCE) stack in Rust.

Layers, bottom-up: ndr — NDR (Network Data Representation) transfer-syntax marshaling. pdu — connection-oriented RPC PDUs (bind / bind_ack / request / response / fault). transport — ncacn_ip_tcp (RPC directly over TCP). epm — endpoint mapper (ept_map): interface UUID → dynamic port. samr — the SAMR interface (UUID/opnums/structs); rides a named-pipe transport.

Interface UUIDs are parsed from their canonical strings via windows_sddl::sid::Guid, whose byte layout already matches the DCE UUID on-wire encoding.

Modules

dcom

DCOM (MS-DCOM) — the foundation for remote activation and WMI execution over ORPC.

dcom_wmi

WMI execution over DCOM (MS-DCOM + MS-WMI), the wmiexec primitive, built on the crate::dcom OXID-resolver foundation. Staged:

dfsnm

MS-DFSNM coercion (DFSCoerce) — NetrDfsAddStdRoot forces the DC to open a DFS root on an attacker-controlled server name, triggering outbound NTLM/Kerberos auth (relayable). Rides the SMB named-pipe DCE/RPC transport on \netdfs.

drsuapiDeprecated

DRSUAPI (MS-DRSR) — the directory replication interface used for DCSync.

efsr

MS-EFSR coercion (PetitPotam) — EfsRpcOpenFileRaw forces the DC to open an attacker UNC path, triggering outbound NTLM/Kerberos auth (relayable). Rides the SMB named-pipe DCE/RPC transport; the EFSRPC interface is reachable on \lsarpc and \efsrpc.

epm

Endpoint Mapper (MS-RPCE §2.2.1.2 / C706 EPM) — resolves an interface UUID to the dynamic TCP port a service listens on. Reachable on TCP/135 without authentication, so it is the first end-to-end exercise of the whole stack: bind + NDR + request/response.

fsrvp

MS-FSRVP coercion (ShadowyCoerce) — IsPathSupported forces the VSS/File-Server-Remote-VSS provider on the target to reach the given ShareName, triggering outbound NTLM/Kerberos auth (relayable). Rides the SMB named-pipe DCE/RPC transport on \FssagentRpc.

icpr

MS-ICPR — ICertPassage remote certificate enrollment (\PIPE\cert). CertServerRequest submits a PKCS#10 CSR with a CertificateTemplate:<name> attribute; on an ESC1 template the CA honors the CSR’s SAN and issues a client-auth cert for the requested principal. Requires a sealed RPC bind (the CA rejects plaintext).

krb_seal

Kerberos GSS-API WRAP token (RFC 4121 §4.2) primitives for sealed DCE/RPC binds.

lsat

LSAT / LSARPC (MS-LSAT) — SID ⇄ name translation over the \lsarpc named pipe. Rides the same SMB DCE/RPC transport as SAMR. Implements OpenPolicy2 + LookupNames (name → SID), the classic recon primitive that also enables RID cycling.

ndr

NDR (Network Data Representation) marshaling.

netlogon

MS-NRPC (Netlogon) — enough of the secure-channel setup to detect Zerologon (CVE-2020-1472) without touching the machine password.

pdu

Connection-oriented DCE/RPC PDUs (MS-RPCE §2.2.6, DCE 1.1 §12.6). Little-endian DREP.

rprn

MS-RPRN coercion (PrinterBug / SpoolSample) — RpcOpenPrinter + RpcRemoteFindFirstPrinterChangeNotificationEx force the target’s Print Spooler to connect back to an attacker UNC path, triggering outbound machine-account auth (relayable, e.g. to LDAP for RBCD/shadow-cred). Rides the SMB \spoolss named pipe.

rrp

MS-RRP — the Windows Remote Registry protocol over \PIPE\winreg. Read remote registry values, which is what several AD CS ESC detections need but LDAP can’t see:

samr

SAMR (MS-SAMR) — the Security Account Manager Remote protocol: enumerate domains, users, groups, and (via aliases) local administrators. Exposed only over the \PIPE\samr named pipe, so it rides an authenticated SMB transport (the next layer); the interface identity and NDR request marshaling live here.

srvsvc

SRVSVC (MS-SRVS) — NetrSessionEnum over the \srvsvc named pipe.

svcctl

SVCCTL (MS-SCMR) — the Service Control Manager Remote protocol. This is the psexec primitive: open the SCM, create a service whose binary path is an arbitrary command, start it (the command runs as LocalSystem; the SCM reports a start “timeout” because a command is not a real service — expected), then delete the service. Rides the same authenticated \PIPE\svcctl SMB transport the SAMR/LSAT clients use.

transport

ncacn_ip_tcp — connection-oriented RPC directly over TCP. Drives one bound interface: bind once, then issue requests and read the (single-fragment) responses.

tsch

TSCH (MS-TSCH) — the Task Scheduler Remote protocol, the atexec primitive. Register a task whose action runs a command as LocalSystem, run it on demand, then delete it. Rides the authenticated \PIPE\atsvc SMB transport like SAMR/SVCCTL. An alternative to the SVCCTL exec (different telemetry — 4698 task-created vs 4697 service-installed).

wkssvc

WKSSVC (MS-WKST) — NetrWkstaUserEnum over the \wkssvc named pipe.

Structs

Syntax

A DCE/RPC abstract syntax: interface UUID + version.

Enums

RpcError

Functions

ndr_transfer_syntax

The NDR transfer syntax (v2.0) every bind offers.

Type Aliases

Result