RPC/NFS (111/135)

rpcclient

# Null Auth
└─$ rpcclient -U "" -N 10.10.10.10
rpcclient $>

# Query User
rpcclient $> enumdomusers

# Query Group
rpcclient $> enumdomgroups

└─$ rpcclient -W '' -c querydispinfo -U''%'' $ip

showmount -e 10.10.10.10