Using NULL sessions: the usual way

• Opening a named pipe that can be opened anonymously

  • Either one of the six hardcoded named pipes or one appearing in NullSessionPipes

• Binding to the RPC interface supported by the named pipe

• Examples

  • Opening \pipe\lsarpc and binding to lsarpc
  • Opening \pipe\samr and binding to samr
  • Opening \pipe\netlogon and binding to netlogon
  • Opening \pipe\srvsvc and binding to srvsvc
  • Opening \pipe\wkssvc and binding to wkssvc
  • ...