MsRPC & SunRpc Audit

MsRPC Audit

Audit MSRPC, is a Microsoft implementation of DCE RPC. The auditor dump is a list of named pipes that are used by Windows RPC services as endpoints. The interface identifier associated with each named pipe represents the service typically accessed when a given named pipe is used.

Enter the Target IP Address by clicking on the Browse button and select the Transport Protocol from the combobox.

This tool supports the following protocol types TCP/IP transport, UDP/IP transport, SMB named pipe transport, Local RPC transport, HTTP transport.

Click on the button IDIDs to dump information for the specified TCP port.

To dump information about all available ports select All Transports Protocols Recursive and click on the button RPC Dump.

SunRpc Audit

SunRpc Auditor is a tool to examine Remote Procedure Call (RPC ) services for vulnerabilities. An audit that looks for the existence of a vulnerable rpc server running on a remote computer will fall under this section.

This tool allows you to dump a portmap in the Pormap List.

The portmap list contains the following fields:

• Program ( the program name using the port ), Version, Protocol ( the protocol name ),
• Port ( port number), Description ( port description ) , Audit Information.
• To start audit enter the Target Hostname or IP Address and click on the Dump Portmap button. You should also specify the protocol type ( Portmap TCP or Portmap UDP).