Impacket rpcdump.py

rpcdump.py <domain>/<user>:'<pass>'@<target-ip>

Enumerates available RPC endpoints on a host, identifying services and potential vulnerabilities.

To discover exposed RPC services on a host, such as AD management interfaces, Exchange, or SQL servers. This gives you an idea of attack capabilities (e.g., MS-RPRN for PrinterBug).

If the host has no accessible RPC or if the firewall blocks dynamic ports.