Microsoft RPC Endpoint Mapper

Microsoft RPC Endpoint Mapper

d95afe70-a6d5-4259-822e-2c84da1ddb0d
  version: v1.0
  protocol: [MS-RSP]: Remote Shutdown Protocol
  provider: wininit.exe
  ncacn_ip_tcp: 210.242.49.110:1025
  ncalrpc: WindowsShutdown
  ncacn_np: \\SERVER\PIPE\InitShutdown
  ncalrpc: WMsgKRpc09C660

76f226c3-ec14-4325-8a99-6a46348418af
  version: v1.0
  provider: winlogon.exe
  ncalrpc: WindowsShutdown
  ncacn_np: \\SERVER\PIPE\InitShutdown
  ncalrpc: WMsgKRpc09C660
  ncalrpc: WMsgKRpc09C891

c9ac6db5-82b7-4e55-ae8a-e464ed7b4277
  version: v1.0
  annotation: Impl friendly name
  provider: sysntfy.dll
  ncalrpc: LRPC-bc875929ae6dd82e54
  ncacn_np: \\SERVER\PIPE\srvsvc
  ncacn_ip_tcp: 210.242.49.110:1028
  ncacn_np: \\SERVER\PIPE\atsvc
  ncalrpc: senssvc
  ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
  ncalrpc: IUserProfile2
  ncalrpc: senssvc
  ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
  ncalrpc: IUserProfile2
  ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
  ncalrpc: IUserProfile2
  ncalrpc: IUserProfile2
  ncalrpc: LRPC-5d4ac7c86699b7aa1d

12e65dd8-887f-41ef-91bf-8d816c42c2e7
  version: v1.0
  annotation: Secure Desktop LRPC interface
  provider: winlogon.exe
  ncalrpc: WMsgKRpc09C891

b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86
  version: v1.0
  annotation: KeyIso
  provider: keyiso.dll
  ncacn_ip_tcp: 210.242.49.110:1026
  ncalrpc: samss lpc
  ncalrpc: dsrole
  ncacn_np: \\SERVER\PIPE\protected_storage
  ncalrpc: protected_storage
  ncalrpc: lsasspirpc
  ncalrpc: lsapolicylookup
  ncalrpc: LSARPC_ENDPOINT
  ncalrpc: securityevent
  ncalrpc: audit
  ncalrpc: LRPC-e07368fd7c6cc585f1
  ncacn_np: \\SERVER\pipe\lsass

12345778-1234-abcd-ef00-0123456789ac
  version: v1.0
  protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol
  provider: samsrv.dll
  ncacn_ip_tcp: 210.242.49.110:1026
  ncalrpc: samss lpc
  ncalrpc: dsrole
  ncacn_np: \\SERVER\PIPE\protected_storage
  ncalrpc: protected_storage
  ncalrpc: lsasspirpc
  ncalrpc: lsapolicylookup
  ncalrpc: LSARPC_ENDPOINT
  ncalrpc: securityevent
  ncalrpc: audit
  ncalrpc: LRPC-e07368fd7c6cc585f1
  ncacn_np: \\SERVER\pipe\lsass

30adc50c-5cbc-46ce-9a0e-91914789e23c
  version: v1.0
  annotation: NRP server endpoint
  provider: nrpsrv.dll
  ncalrpc: dhcpcsvc
  ncalrpc: dhcpcsvc6
  ncacn_ip_tcp: 210.242.49.110:1027
  ncacn_np: \\SERVER\pipe\eventlog
  ncalrpc: eventlog

3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5
  version: v1.0
  annotation: DHCP Client LRPC Endpoint
  provider: dhcpcsvc.dll
  ncalrpc: dhcpcsvc
  ncalrpc: dhcpcsvc6
  ncacn_ip_tcp: 210.242.49.110:1027
  ncacn_np: \\SERVER\pipe\eventlog
  ncalrpc: eventlog

3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6
  version: v1.0
  annotation: DHCPv6 Client LRPC Endpoint
  provider: dhcpcsvc6.dll
  ncalrpc: dhcpcsvc6
  ncacn_ip_tcp: 210.242.49.110:1027
  ncacn_np: \\SERVER\pipe\eventlog
  ncalrpc: eventlog

f6beaff7-1e19-4fbb-9f8f-b89e2018337c
  version: v1.0
  annotation: Event log TCPIP
  protocol: [MS-EVEN6]: EventLog Remoting Protocol
  provider: wevtsvc.dll
  ncacn_ip_tcp: 210.242.49.110:1027
  ncacn_np: \\SERVER\pipe\eventlog
  ncalrpc: eventlog

98716d03-89ac-44c7-bb8c-285824e51c4a
  version: v1.0
  annotation: XactSrv service
  provider: srvsvc.dll
  ncacn_ip_tcp: 210.242.49.110:1028
  ncacn_np: \\SERVER\PIPE\atsvc
  ncalrpc: senssvc
  ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
  ncalrpc: IUserProfile2

552d076a-cb29-4e44-8b6a-d15e59e2c0af
  version: v1.0
  annotation: IP Transition Configuration endpoint
  provider: iphlpsvc.dll
  ncacn_ip_tcp: 210.242.49.110:1028
  ncacn_np: \\SERVER\PIPE\atsvc
  ncalrpc: senssvc
  ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
  ncalrpc: IUserProfile2

a398e520-d59a-4bdd-aa7a-3c1e0303a511
  version: v1.0
  annotation: IKE/Authip API
  provider: IKEEXT.DLL
  ncacn_ip_tcp: 210.242.49.110:1028
  ncacn_np: \\SERVER\PIPE\atsvc
  ncalrpc: senssvc
  ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
  ncalrpc: IUserProfile2

86d35949-83c9-4044-b424-db363231fd0c
  version: v1.0
  protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
  provider: schedsvc.dll
  ncacn_ip_tcp: 210.242.49.110:1028
  ncacn_np: \\SERVER\PIPE\atsvc
  ncalrpc: senssvc
  ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
  ncalrpc: IUserProfile2

378e52b0-c0a9-11cf-822d-00aa0051e40f
  version: v1.0
  protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
  provider: taskcomp.dll
  ncacn_np: \\SERVER\PIPE\atsvc
  ncalrpc: senssvc
  ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
  ncalrpc: IUserProfile2

1ff70682-0a51-30e8-076d-740be8cee98b
  version: v1.0
  protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
  provider: taskcomp.dll
  ncacn_np: \\SERVER\PIPE\atsvc
  ncalrpc: senssvc
  ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
  ncalrpc: IUserProfile2

0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53
  version: v1.0
  provider: schedsvc.dll
  ncalrpc: senssvc
  ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
  ncalrpc: IUserProfile2

2eb08e3e-639f-4fba-97b1-14f878961076
  version: v1.0
  provider: gpsvc.dll
  ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
  ncalrpc: IUserProfile2

3473dd4d-2e88-4006-9cba-22570909dd10
  version: v5.256
  annotation: WinHttp Auto-Proxy Service
  ncacn_np: \\SERVER\PIPE\W32TIME_ALT
  ncalrpc: W32TIME_ALT
  ncalrpc: LRPC-830d0e65374fbf26e4
  ncalrpc: OLEDDEAEE88AC574E72867C4BDAF8AD

7ea70bcf-48af-4f6a-8968-6a440754d5fa
  version: v1.0
  annotation: NSI server endpoint
  provider: nsisvc.dll
  ncalrpc: LRPC-830d0e65374fbf26e4
  ncalrpc: OLEDDEAEE88AC574E72867C4BDAF8AD

266f33b4-c7c1-4bd1-8f52-ddb8f2214ea9
  version: v1.0
  annotation: Wlan Service
  provider: wlansvc.dll
  ncalrpc: LRPC-5d4ac7c86699b7aa1d

25952c5d-7976-4aa1-a3cb-c35f7ae79d1b
  version: v1.256
  annotation: Wireless Diagnostics
  ncalrpc: LRPC-5d4ac7c86699b7aa1d

2fb92682-6599-42dc-ae13-bd2ca89bd11c
  version: v1.0
  annotation: Fw APIs
  provider: MPSSVC.dll
  ncalrpc: LRPC-26a42d32b8ec87b4e8

7f9d11bf-7fb9-436b-a812-b2d50c5d4c03
  version: v1.0
  annotation: Fw APIs
  provider: MPSSVC.dll
  ncalrpc: LRPC-26a42d32b8ec87b4e8

dd490425-5325-4565-b774-7e27d6c09c24
  version: v1.0
  annotation: Base Firewall Engine API
  provider: BFE.DLL
  ncalrpc: LRPC-26a42d32b8ec87b4e8

7f1343fe-50a9-4927-a778-0c5859517bac
  version: v1.0
  annotation: DfsDs service
  ncacn_np: \\SERVER\PIPE\wkssvc
  ncalrpc: DNSResolver

4a452661-8290-4b36-8fbe-7f4093a94978
  version: v1.0
  annotation: Spooler function endpoint
  provider: spoolsv.exe
  ncalrpc: spoolss

ae33069b-a2a8-46ee-a235-ddfd339be281
  version: v1.0
  annotation: Spooler base remote object endpoint
  protocol: [MS-PAN]: Print System Asynchronous Notification Protocol
  provider: spoolsv.exe
  ncalrpc: spoolss

0b6edbfa-4a24-4fc6-8a23-942b1eca65d1
  version: v1.0
  annotation: Spooler function endpoint
  protocol: [MS-PAN]: Print System Asynchronous Notification Protocol
  provider: spoolsv.exe
  ncalrpc: spoolss

1a9134dd-7b39-45ba-ad88-44d01ca47f28
  version: v1.0
  annotation: Message Queuing - RemoteRead V1
  protocol: [MS-MQRR]: Message Queuing (MSMQ):
  provider: mqqm.dll
  ncacn_ip_tcp: 210.242.49.110:2105
  ncacn_ip_tcp: 210.242.49.110:2103
  ncacn_ip_tcp: 210.242.49.110:2107
  ncacn_ip_tcp: 210.242.49.110:1029
  ncalrpc: QMMgmtFacility$server
  ncalrpc: QMsvc$server

1088a980-eae5-11d0-8d9b-00a02453c337
  version: v1.0
  annotation: Message Queuing - QM2QM V1
  protocol: [MS-MQQP]: Message Queuing (MSMQ):
  provider: mqqm.dll
  ncacn_ip_tcp: 210.242.49.110:2105
  ncacn_ip_tcp: 210.242.49.110:2103
  ncacn_ip_tcp: 210.242.49.110:2107
  ncacn_ip_tcp: 210.242.49.110:1029
  ncalrpc: QMMgmtFacility$server
  ncalrpc: QMsvc$server

76d12b80-3467-11d3-91ff-0090272f9ea3
  version: v1.0
  annotation: Message Queuing - QMRT V2
  protocol: [MS-MQMP]: Message Queuing (MSMQ):
  provider: mqqm.dll
  ncacn_ip_tcp: 210.242.49.110:2105
  ncacn_ip_tcp: 210.242.49.110:2103
  ncacn_ip_tcp: 210.242.49.110:2107
  ncacn_ip_tcp: 210.242.49.110:1029
  ncalrpc: QMMgmtFacility$server
  ncalrpc: QMsvc$server

fdb3a030-065f-11d1-bb9b-00a024ea5525
  version: v1.0
  annotation: Message Queuing - QMRT V1
  protocol: [MS-MQMP]: Message Queuing (MSMQ):
  provider: mqqm.dll
  ncacn_ip_tcp: 210.242.49.110:2105
  ncacn_ip_tcp: 210.242.49.110:2103
  ncacn_ip_tcp: 210.242.49.110:2107
  ncacn_ip_tcp: 210.242.49.110:1029
  ncalrpc: QMMgmtFacility$server
  ncalrpc: QMsvc$server

12d4b7c8-77d5-11d1-8c24-00c04fa3080d
  version: v1.0
  provider: lserver.dll
  ncacn_ip_tcp: 210.242.49.110:1030
  ncacn_np: \\SERVER\pipe\HydraLsPipe
  ncalrpc: LRPC-9edc8b3a30bf20d722

3d267954-eeb7-11d1-b94e-00c04fa3080d
  version: v1.0
  provider: lserver.dll
  ncacn_ip_tcp: 210.242.49.110:1030
  ncacn_np: \\SERVER\pipe\HydraLsPipe
  ncalrpc: LRPC-9edc8b3a30bf20d722

367abb81-9844-35f1-ad32-98f038001003
  version: v2.0
  protocol: [MS-SCMR]: Service Control Manager Remote Protocol
  provider: services.exe
  ncacn_ip_tcp: 210.242.49.110:1041

12345678-1234-abcd-ef00-0123456789ab
  version: v1.0
  annotation: IPSec Policy agent endpoint
  protocol: [MS-RPRN]: Print System Remote Protocol
  provider: spoolsv.exe
  ncalrpc: LRPC-363646a512fa67ff45
  ncacn_ip_tcp: 210.242.49.110:1042

6b5bdd1e-528c-422c-af8c-a4079be4fe48
  version: v1.0
  annotation: Remote Fw APIs
  protocol: [MS-FASP]: Firewall and Advanced Security Protocol
  provider: FwRemoteSvr.dll
  ncacn_ip_tcp: 210.242.49.110:1042

906b0ce0-c70b-1067-b317-00dd010662da
  version: v1.0
  protocol: [MS-CMPO]: MSDTC Connection Manager:
  provider: msdtcprx.dll
  ncalrpc: LRPC-928e132690b68437a0
  ncalrpc: LRPC-928e132690b68437a0
  ncalrpc: LRPC-928e132690b68437a0
  ncalrpc: LRPC-928e132690b68437a0

SMB Status:
  Authentication: enabled
  SMB Version: 1
  OS: Windows Server 2008 R2 Enterprise 7601 Service Pack 1
  Software: Windows Server 2008 R2 Enterprise 6.1
  Capabilities: extended-security, infolevel-passthru, large-files, large-readx, large-writex, level2-oplocks, lock-and-read, lwio, nt-find, nt-smb, nt-status, rpc-remote-api, unicode

Microsoft Message Queuing

\x10Z\x0b\x00LIOR<\x02\x00\x00\xff\xff\xff\xff\x00\x00\x12\x00\x06U=Q6\xdf\xc7@\x96C\x17\\<\xe7l\xaa?6RI\xcd\x9e\x91O\x82\xd7\xa1-8H\x13^\x00\x00\x00\x00\x10\x02\x00\x00ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ

Remote Desktop Protocol

Remote Desktop Protocol
\x03\x00\x00\x13\x0e\xd0\x00\x00\x124\x00\x02\t\x08\x00\x02\x00\x00\x00
Remote Desktop Protocol NTLM Info:
  OS: Windows 7/Windows Server 2008 R2
  OS Build: 6.1.7601
  Target Name: SERVER
  NetBIOS Domain Name: SERVER
  NetBIOS Computer Name: SERVER
  DNS Domain Name: SERVER
  FQDN: SERVER

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2e:5a:99:59:38:09:e2:a7:4b:f2:8a:d4:42:a7:e7:18
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN=SERVER
        Validity
            Not Before: Jun 30 17:00:17 2024 GMT
            Not After : Dec 30 17:00:17 2024 GMT
        Subject: CN=SERVER
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a6:69:70:65:ae:0b:96:bd:62:3c:ed:7e:61:c8:
                    64:7f:93:7d:a1:c3:19:0c:e2:31:7f:9e:28:e4:ec:
                    21:53:35:15:50:60:22:ba:d9:b8:a4:26:b6:5d:46:
                    fc:2c:62:c4:55:6e:57:ba:ce:e4:04:8a:14:8c:f8:
                    56:4c:7b:f8:62:f2:94:d8:0b:d2:9a:92:a3:7d:76:
                    c5:78:d3:81:88:80:db:c1:7d:b6:8c:ee:5a:22:c8:
                    46:90:2f:dc:78:64:c0:28:8e:6a:45:ae:03:4f:06:
                    b1:3e:9f:1e:a5:b9:2e:43:03:96:66:47:35:8c:c2:
                    b0:82:18:0b:8d:62:91:5b:df:c5:95:95:5f:68:ef:
                    58:e6:0a:ad:8c:a8:69:bd:1e:4b:03:b2:5e:84:f4:
                    ba:1c:91:e6:ea:57:e6:9e:1f:3d:8b:07:e0:fd:5d:
                    3d:cb:bf:73:69:d9:9b:13:be:9f:3b:d2:56:9e:05:
                    cb:2c:e0:05:a5:46:e8:7e:33:36:33:0b:c7:06:8e:
                    00:83:a6:a2:f3:85:68:a5:4a:84:22:df:f9:8b:81:
                    a8:32:8d:e0:47:00:e1:e4:af:7b:46:63:40:a9:1d:
                    a2:9d:4e:03:e6:eb:dc:9e:97:82:cc:ff:84:e8:27:
                    76:19:06:76:c1:ef:ff:7a:ce:aa:25:fa:8f:1e:d7:
                    b9:7f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            X509v3 Key Usage: 
                Key Encipherment, Data Encipherment
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        62:27:f6:24:6e:15:04:c4:6b:85:94:69:44:46:38:a3:86:58:
        cd:19:b4:4a:38:fd:09:3e:66:40:e4:cd:25:c7:36:3e:44:8a:
        23:6f:bf:8d:d4:bc:1e:e2:f7:ee:d1:d5:d8:de:11:0d:f9:ac:
        bd:27:e8:93:40:bd:7e:6d:4b:1f:fc:3a:12:c7:1c:68:65:fe:
        55:ef:db:c3:00:ca:4b:28:db:95:74:98:e4:71:76:16:b4:8f:
        c8:2f:ca:04:32:eb:d9:00:fe:77:a7:df:a6:2b:c4:69:ec:57:
        b1:18:96:dc:7c:d4:0b:43:ae:cf:d5:f6:7f:d6:43:3d:ad:0a:
        fb:64:ad:1a:d2:a5:f5:9f:46:1c:3a:bc:e2:14:47:63:46:08:
        3e:53:23:7c:7f:b5:73:b8:46:3f:2e:88:4e:3c:68:89:20:23:
        be:a3:2e:2c:a6:b2:03:9a:1d:b2:b4:2a:e3:4b:cb:d3:82:4b:
        1d:e7:f8:f4:62:6d:be:ee:95:bc:dc:8e:31:72:87:51:68:a1:
        15:db:8c:0e:9e:0b:d7:a9:9f:6b:66:7b:41:8a:41:bc:53:63:
        3f:da:46:7b:b9:f2:50:c0:fd:10:13:77:0f:04:ea:5c:13:04:
        d4:c7:6c:c5:09:85:57:41:ca:fb:45:3f:27:1b:c7:74:91:3a:
        07:ad:84:4e

WinRM

HTTP/1.1 404 Not Found
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Tue, 10 Sep 2024 15:29:53 GMT
Connection: close
Content-Length: 315


WinRM NTLM Info:
  OS: Windows Server 2008 R2
  OS Build: 6.1.7601
  Target Name: SERVER
  NetBIOS Domain Name: SERVER
  NetBIOS Computer Name: SERVER
  DNS Domain Name: SERVER
  FQDN: SERVER