A journey into the forgotten Null Session and MS-RPC interfaces

This Kaspersky research article demonstrates that certain MS-RPC interfaces on Windows domain controllers can be accessed with AUTHN_LEVEL_NONE (no authentication) over TCP endpoints, enabling remote enumeration of network interfaces and Active Directory data (user and computer existence via DsrGetDcNameEx2, trusted domains via NetrEnumerateTrustedDomainsEx). The author details a methodology using endpoint enumeration (epmapper, Nmap), Impacket tools (rpcdump/rpcmap), OPNUM brute-forcing, and RPCView/Wireshark traffic analysis to identify callable RPC methods (including IOObjectExporter ServerAlive2 and MS-NRPC functions) that return useful domain information even when null sessions and the 'Restrict Unauthenticated RPC Clients' policy are in place, discusses implications for reconnaissance, and points to a tool implementing these techniques.