A journey into forgotten Null Session and MS-RPC interfaces

This research examines how legacy null session concepts can be resurfaced by leveraging MS-RPC/DCOM interfaces—specifically IObjectExporter’s ServerAlive2 on TCP 135—to enumerate a domain controller’s network interfaces and potentially domain information without authentication. It reviews historical controls (e.g., named pipe policies), shows that certain DCOM calls operate at no-auth levels, and proposes a methodology to identify additional interfaces enabling anonymous enumeration, offering guidance and tooling for security researchers and penetration testers.