« Version 4.1 - 3.11 Netlogon, NetBIOS and SMB | Main | Version 4.1 - 3.13 RDP and VNC »

Version 4.1 - 3.12 RPCs

RPC Remote Procedure Call is a mechanism of data exchange between two devices. The Wikipedia page is good, but the Microsoft page on RPC seems to be a bit better. When you see this, think of CORBA (Common Object Request Broker Architecture) and "named pipes." This is another topic like 3.11 - where you should know, understand and be familiar with the concepts, but I don't think you'll see a question that directly asks you about it.

Note that the Microsoft page has a table with the services and the related TCP / UDP ports.
Named Pipes use tcp | udp port 445. RPC Endpoint Mapper uses tcp | udp port 135.

A security alert from Cisco's pages gives you an idea of why they included this in the blueprint:

The services on Microsoft operating systems that use RPC on ports 135/tcp and 135/udp include the following:
Client/Server Communication (135/udp)
DCOM (135/tcp)
Dynamic Host Configuration Protocol (DHCP) Manager (135/udp)
Exchange Administrator (135/udp)
Message Queue Server (135/udp)
Service Control Manager (135/tcp and 135/udp)
SQL Session Manager (135/udp)
Windows Internet Naming Service (WINS) Manager (135/udp)

Over the years, there have been several serious security issues linked to Microsoft's RPC services, including denial of service (DoS) issues, arbitrary code execution and privilege escalation. 

Again, an important place to learn more about this is the Wireshark Wiki page and the Wireshark sample capture page.

Again, it's just like section 3.11 where you're probably not going to get a direct question on this topic. So I'm going to limit my discussion here. As long as you have a familiarity with this, I'm sure that will be enough for the exam. It will probably appear as part of a question on some other section.

Sections

Powered by
Movable Type 3.2