🛠️ Net RPC

Installation

sudo apt install smbclient   # Samba's `net` binary ships alongside it, usually already present

Command	Description
`net rpc password '<user>' '<newpass>' -U '<domain>'/'<controller>'%'<pass>' -S '<dc>'`	Reset `<user>`’s password over `SAMR` — the practical form of Active Directory - ACL Abuse (GenericAll & ForceChangePassword) once `GenericAll`/`ForceChangePassword` is held.
`net rpc group addmem '<group>' '<user>' -U '<domain>'/'<user>'%'<pass>' -S '<dc>'`	Add `<user>` as a member of `<group>` — the last step of Active Directory - Ownership Abuse (WriteOwner & WriteDacl) once full control of the group object is held.
`net rpc group members '<group>' -U '<domain>'/'<user>'%'<pass>' -S '<dc>'`	List a group’s current membership.
`net rpc user -U '<domain>'/'<user>'%'<pass>' -S '<dc>'`	List every domain user account, no elevated rights needed beyond a valid domain credential.

net rpc talks straight to SAMR/LSARPC over SMB — no Python/Impacket install needed, which makes it a good fallback on a minimal attack box or when a target’s SMB signing config is picky about a specific client stack.
Every subcommand accepts -S '<dc_fqdn_or_ip>' explicitly — pointing it at the wrong DC (in a multi-DC domain) silently fails rather than erroring clearly, so double-check this if a command that should work doesn’t.
The -U 'domain'/'user'%'pass' credential format is easy to get backwards under time pressure — it’s domain first, then a literal /, then user, then a literal %, then password.

File	Created
HTB - Certified	July 23, 2026

References: Samba net manpage