rpcclient
MS-RPC enumeration (users, groups) over SMB.
An MS-RPC client (Samba) to talk to a Windows target's service. With a null session or credentials it enumerates users, groups, policies and SIDs (enumdomusers, querydispinfo, lookupnames). Very useful to pull the domain user list.
Family SMB, NetBIOS & RPC
Flags -U '' -N -c enumdomusers
Concepts Password Spraying, RID cycling
Cheatsheet SMB · 139 / 445
Installation
sudo apt install -y samba-common-binUseful commands
Appears in
Some machines where its use is documented; not an exhaustive list.