MSRPC

Scanners

MSF

• auxiliary/scanner/dcerpc/endpoint_mapper
• auxiliary/scanner/dcerpc/hidden

Impacket

• rpcmap.py 'ncan_ip_tcp:10.10.10.213' -brute-uuids -brute-opnums -auth-level 1 -opnum-max 5

Enumeration

• mubix/IOXIDResolver: IOXIDResolver.py from AirBus Security (github.com)

References

The OXID Resolver [Part 1] - Remote enumeration of network interfaces without any authentication - Airbus CyberSecurity (airbus-cyber-security.com)