DCERPC

DCERPC, short for Distributed Computing Environment / Remote Procedure Call, is a protocol framework used to enable remote procedure calls in computing environments. It originated from the OSF DCE RPC specification and is implemented in Windows as part of the DCE/RPC framework, providing a means for applications to invoke procedures on remote systems as if they were local.

DCERPC defines interfaces described in an interface definition language and relies on an RPC runtime to handle parameter marshaling, binding, and authentication. Clients locate remote interfaces via an endpoint mapper service that assigns network endpoints. A typical transaction involves binding to a specific interface on the target, performing a sequence of procedure calls, and then unbinding.

Transports used by DCERPC include TCP/IP, with port 135 historically serving the endpoint mapper and dynamically assigned ports used for actual calls. Windows DCERPC also supports named pipes over SMB and, in some configurations, HTTP-based transports. The protocol accommodates multiple transfer syntaxes and can operate over various transports supported by the host.

Security in DCERPC is provided through RPC security mechanisms based on GSS-API and SPNEGO, enabling authentication with Kerberos or NTLM, and offering integrity and privacy services. Authorization is enforced on the server side for each interface and operation.

DCERPC is widely used in Windows for management and inter-process communication, including remote administration and various services. Open-source implementations, such as Samba and Wine, provide cross-platform interoperability with Windows DCERPC endpoints. Proper configuration and patching are important to mitigate exposure of DCERPC endpoints to potential security risks.