go-msrpc

July 2, 2026 ยท View on GitHub

Go Reference Go Report Card

MS-RPC/DCOM client library for Go. Implements the Microsoft Extension of C706: DCE/RPC 1.1 and includes ready-to-use generated stubs for all major Windows RPC and DCOM protocols: Netlogon, Windows Registry, Eventlog, WMI (query, exec), DCOM/OXID, and many more.

Installation

go get github.com/oiweiwei/go-msrpc

Quick Start

package main

import (
    "context"
    "fmt"

    "github.com/oiweiwei/go-msrpc/dcerpc"
    "github.com/oiweiwei/go-msrpc/msrpc/rrp/winreg/v1"
    "github.com/oiweiwei/go-msrpc/ssp"
    "github.com/oiweiwei/go-msrpc/ssp/credential"
    "github.com/oiweiwei/go-msrpc/ssp/gssapi"

    _ "github.com/oiweiwei/go-msrpc/msrpc/erref/win32"
)

func main() {
    ctx := gssapi.NewSecurityContext(context.Background(),
        gssapi.WithCredential(credential.NewFromPassword("DOMAIN\\User", "password")),
        gssapi.WithMechanismFactory(ssp.SPNEGO),
        gssapi.WithMechanismFactory(ssp.NTLM),
    )

    // connect to server
    cc, err := dcerpc.Dial(ctx, "192.168.1.1", dcerpc.WithEndpoint("ncacn_np:[winreg]"))
    if err != nil {
        panic(err)
    }

    // create protocol client (MS-RRP)
    cli, err := winreg.NewWinregClient(ctx, cc, dcerpc.WithSeal())
    if err != nil {
        panic(err)
    }

    // make RPC call
    resp, err := cli.OpenLocalMachine(ctx, &winreg.OpenLocalMachineRequest{
        DesiredAccess: winreg.KeyRead,
    })
    if err != nil {
        panic(err)
    }

    fmt.Printf("HKLM handle: %v\n", resp.Key)
}

See examples/samples_with_config and the msrpc package documentation.

# Using string binding format
go run examples/samples_with_config/dnsp.go Administrator%P@ssw0rd@ncacn_ip_tcp:dc01.msad.local[privacy,spnego,krb5]

go run examples/samples_with_config/wmic.go Administrator%P@ssw0rd@ncacn_ip_tcp:dc01.msad.local[privacy,spnego,krb5] \
    --query "SELECT * FROM Win32_ComputerSystem"

# Using explicit flags
go run examples/samples_with_config/dnsp.go \
    --username=Administrator \
    --domain=MSAD.LOCAL \
    --password=P@ssw0rd \
    --auth-level=privacy \
    --auth-spnego \
    --auth-type=krb5 \
    --server=dc01.msad.local

Older examples in examples/ use environment variables instead:

VariableDescriptionExample
USERNAMEDomain\Username"MSAD2.COM\User"
PASSWORDPassword"password"
PASSWORD_MD4NT hash (generate with nt_hash.go)"f077ca4b7d73486a45e75dcdd74cd5bd"
WORKSTATIONWorkstation name"Ubuntu"
SERVERServer FQDN or IP"192.168.0.22"
SERVER_NAMEServer NetBIOS name"WIN2019"
SERVER_HOSTServer FQDN"my-server.win2019.com"
SAM_USERNAMEMachine account name (see netlogon_sec_channel.go)"COMPUTER$"
SAM_PASSWORDMachine account password"password"
SAM_WORKSTATIONMachine account workstation"COMPUTER"
TARGETKerberos SPN"host/my-server.win2019.com"
KRB5_CONFIGKerberos config path"/path/to/krb5.conf"

Tip: RedTeamPentesting/adauth integrates well with this library and provides a convenient way to handle Active Directory authentication (Kerberos, NTLM, pass-the-hash, PKINIT) from command-line tools.

Code Generation

The IDL parser and Go code generator live at github.com/oiweiwei/midl-gen-go and are consumed here via the published Docker image ghcr.io/oiweiwei/midl-gen-go.

Regenerate all stubs:

make all

Regenerate a single protocol (e.g. nrpc.go):

make nrpc.go

Under the hood each target runs:

docker run --rm \
  -v $(pwd):/work \
  -u $(id -u):$(id -g) \
  ghcr.io/oiweiwei/midl-gen-go generate \
  --pkg "github.com/oiweiwei/go-msrpc/msrpc/" \
  -I /work/idl \
  -I /work/idl/h \
  --output /work/msrpc/ \
  --msdn-openspecs-indexer-file /work/msdn/index.yaml \
  --msdn-openspecs-extra-file /work/msdn/extra.yaml \
  --msdn-openspecs-cache-dir /work/msdn/.cache/ \
  /work/idl/<protocol>.idl

To add a new IDL file, place it in idl/ (or idl/dcom/ for DCOM), then add a corresponding target to the all rule in the Makefile.

Features

DCE/RPC v5 Client (dcerpc package)

  • Transfer Syntax: NDR 2.0 and NDR64
  • Transports: Named Pipe (SMB2/3) and TCP
  • Connection multiplexing: multiple clients over a single connection
  • Multiple connections per association group, with shared context handles
  • Verification trailer support
  • Kerberos, Netlogon, NTLM, SPNEGO authentication
  • Endpoint mapper and string binding support
  • Basic DCOM support
  • Eventlog BinXML parser
  • WMIO object marshaler/unmarshaler

MS-RPCE Extensions

  • Security Context Multiplexing
  • Bind-time Feature Negotiation
  • Header Signing
  • NDR64

GSS-API / SSP (ssp package)

GSS-API interface definitions live in ssp/gssapi. The ssp package implements the following security providers:

  • Kerberos (via jcmturner/gokrb5 fork):
    • Encryption: RC4-HMAC, DES-CBC-MD5, DES-CBC-CRC, AES128-CTS-HMAC-SHA1, AES256-CTS-HMAC-SHA1
    • DCE-style AP Request/Reply
    • Mutual and non-mutual authentication
    • Wrap/GetMic-Ex methods
  • NTLM: NTLMv1 and NTLMv2
  • Netlogon: RC4-HMAC and AES-SHA2
  • SPNEGO: MechListMIC and NegTokenInit2

SMB2 Client

Based on the hirochachacha/go-smb2 fork, with the following additions:

  • Force-encryption support
  • Kerberos/NTLM integration via ssp/gssapi
  • Fix for NT_STATUS_PENDING
  • Keying material export (Application Key, Session Key)

Generated Stubs

RPC Protocols

SpecDescriptionPackageRevision
MS-ADTSActive Directory Technical Specification: Claimsmsrpc/adts68.0 Major 5/25/2026
MS-BKRPBackupKey Remote Protocolmsrpc/bkrp27.0 Major 4/23/2024
MS-BPAUBITS Peer-Caching: Peer Authentication Protocolmsrpc/bpau4.2 None 6/1/2017
MS-BRWSACIFS Browser Auxiliary Protocolmsrpc/brwsa15.0 Major 4/23/2024
MS-CAPRCentral Access Policy ID Retrieval Protocolmsrpc/capr9.0 Major 4/23/2024
MS-CMPOMSDTC Connection Manager: OleTx Transports Protocolmsrpc/cmpo31.0 Major 7/29/2024
MS-CMRPFailover Cluster: Management API (ClusAPI) Protocolmsrpc/cmrp44.0 Major 8/11/2025
MS-DFSNMDFS Namespace Management Protocolmsrpc/dfsnm33.0 Major 4/23/2024
MS-DHCPMDHCP Server Management Protocolmsrpc/dhcpm36.0 None 9/16/2024
MS-DLTMDistributed Link Tracking: Central Manager Protocolmsrpc/dltm9.1 None 6/1/2017
MS-DLTWDistributed Link Tracking: Workstation Protocolmsrpc/dltw17.0 Major 4/23/2024
MS-DNSPDNS Server Management Protocolmsrpc/dnsp40.0 Major 3/9/2026
MS-DRSRDirectory Replication Service (DRS) Remote Protocolmsrpc/drsr46.0 Major 3/9/2026
MS-DSSPDirectory Services Setup Remote Protocolmsrpc/dssp16.0 Major 4/23/2024
MS-DTYPWindows Data Typesmsrpc/dtyp42.0 Major 11/19/2024
MS-EERRExtendedError Remote Data Structuremsrpc/eerr16.0 Major 4/23/2024
MS-EFSREncrypting File System Remote (EFSRPC) Protocolmsrpc/efsr32.0 None 9/16/2024
MS-ERREFWindows Error Codesmsrpc/erref23.0 Major 11/19/2024
MS-EVEN6-BINXMLEventLog BinXML encodingmsrpc/binxml25.0 Major 4/23/2024
MS-EVEN6EventLog Remoting Protocol Version 6.0msrpc/even625.0 Major 4/23/2024
MS-EVENEventLog Remoting Protocolmsrpc/even26.0 Major 4/23/2024
MS-FASPFirewall and Advanced Security Protocolmsrpc/fasp36.0 Major 6/8/2026
MS-FAXFax Server and Client Remote Protocolmsrpc/fax29.0 None 4/23/2024
MS-FRS1File Replication Service (FRS) Remote Protocolmsrpc/frs129.0 None 9/16/2024
MS-FSR2File Replication Service (FRS) Remote Protocol Version 2msrpc/frs230.0 Major 4/23/2024
MS-ICPRICertPassage Remote Protocolmsrpc/icpr24.0 Major 4/23/2024
MS-IRPIIS Inetinfo Remote Protocolmsrpc/irp13.0 Major 4/23/2024
MS-LRECLive Remote Event Capture (LREC) Protocolmsrpc/lrec5.0 Major 4/23/2024
MS-LSADLocal Security Authority (Domain Policy) Remote Protocolmsrpc/lsad49.0 Major 6/10/2025
MS-LSATLocal Security Authority (Translation Methods) Remote Protocolmsrpc/lsat33.0 Major 5/1/2024
MS-MQDSMSMQ: Directory Service Protocolmsrpc/mqds24.1 None 6/1/2017
MS-MQMPMSMQ: Queue Manager Client Protocolmsrpc/mqmp31.0 Major 4/23/2024
MS-MQMQMSMQ: Data Structuresmsrpc/mqmq26.0 Major 4/23/2024
MS-MQMRMSMQ: Queue Manager Management Protocolmsrpc/mqmr18.0 Major 4/23/2024
MS-MQQPMSMQ: Queue Manager to Queue Manager Protocolmsrpc/mqqp25.0 Major 4/23/2024
MS-MQRRMSMQ: Queue Manager Remote Read Protocolmsrpc/mqrr29.0 Major 11/21/2025
MS-MSRPMessenger Service Remote Protocolmsrpc/msrp10.3 None 6/1/2017
MS-NEGOEXSPNEGO Extended Negotiation (NEGOEX) Security Mechanismmsrpc/negoex4.0 Major 4/23/2024
MS-NRPC-SECCHANNELNetlogon Secure Channelmsrpc/nrpc49.0 Major 2/9/2026
MS-NRPCNetlogon Remote Protocolmsrpc/nrpc49.0 Major 2/9/2026
MS-NSPIName Service Provider Interface (NSPI) Protocolmsrpc/nspi16.0 Major 4/23/2024
MS-OXABREFAddress Book NSPI Referral Protocolmsrpc/oxabref15.0 Major 5/20/2025
MS-OXCRPCWire Format Protocolmsrpc/oxcrpc25.0 Major 5/20/2025
MS-OXNSPIExchange NSPI Protocolmsrpc/nspi15.0 Major 5/20/2025
MS-PACPrivilege Attribute Certificate Data Structuremsrpc/pac26.0 Major 6/10/2024
MS-PANPrint System Asynchronous Notification Protocolmsrpc/pan19.0 Major 4/23/2024
MS-PARPrint System Asynchronous Remote Protocolmsrpc/par19.0 Major 8/11/2025
MS-PCQPerformance Counter Query Protocolmsrpc/pcq18.0 Major 4/23/2024
MS-RAARemote Authorization API Protocolmsrpc/raa11.0 Major 4/23/2024
MS-RAIWRemote Administrative Interface: WINSmsrpc/raiw14.0 Major 4/23/2024
MS-RPCE-EPM / C706-EPMEndpoint Mappermsrpc/epm
MS-RPCLRPC Location Services Extensionsmsrpc/rpcl12.1 None 6/1/2017
MS-RPRNPrint System Remote Protocolmsrpc/rprn39.0 8/11/2025
MS-RRPWindows Remote Registry Protocolmsrpc/rrp39.0 Major 10/21/2024
MS-RSPRemote Shutdown Protocolmsrpc/rsp12.0 Major 4/23/2024
MS-SAMRSecurity Account Manager (SAM) Remote Protocolmsrpc/samr51.1 Minor 4/27/2026
MS-SCMRService Control Manager Remote Protocolmsrpc/scmr35.0 Major 8/11/2025
MS-SRVSServer Service Remote Protocolmsrpc/srvs39.0 None 9/16/2024
MS-SSPSingle Sign-On Protocolmsrpc/ssp7.0 Major 10/5/2021
MS-SWNService Witness Protocolmsrpc/swn14.0 None 11/19/2024
MS-TRPTelephony Remote Protocolmsrpc/trp20.0 Major 4/23/2024
MS-TSCHTask Scheduler Service Remoting Protocolmsrpc/tsch28.0 Major 4/23/2024
MS-TSGUTerminal Services Gateway Server Protocolmsrpc/tsgu42.0 Major 4/23/2024
MS-TSTSTerminal Services Runtime Interface Protocolmsrpc/tsts33.0 Major 11/21/2025
MS-W32TW32Time Remote Protocolmsrpc/w32t23.0 Major 4/23/2024
MS-WDSCWindows Deployment Services Control Protocolmsrpc/wdsc9.0 Major 4/23/2024
MS-WKSTWorkstation Service Remote Protocolmsrpc/wkst32.0 Major 4/23/2024

DCOM Protocols

SpecDescriptionPackageRevision
MC-CCFGServer Cluster: Configuration (ClusCfg) Protocolmsrpc/dcom/ccfg1.2 None 1/17/2020
MC-IISAIIS Application Host COM Protocolmsrpc/dcom/iisa15.0 Major 4/23/2024
MC-MQACMSMQ: ActiveX Client Protocolmsrpc/dcom/mqac27.0 Major 4/23/2024
MS-ADTGRemote Data Services (RDS) Transport Protocolmsrpc/dcom/adtg19.1 Minor 5/30/2025
MS-COMACOM+ Remote Administration Protocolmsrpc/dcom/coma15.0 Major 4/23/2024
MS-COMEVCOM+ Event System Protocolmsrpc/dcom/comev9.0 Major 9/9/2025
MS-COMTCOM+ Tracker Service Protocolmsrpc/dcom/comt10.0 Major 4/23/2024
MS-COMComponent Object Model Plus (COM+) Protocolmsrpc/dcom/com12.0 Major 4/23/2024
MS-CSRACertificate Services Remote Administration Protocolmsrpc/dcom/csra46.1 Minor 1/13/2026
MS-CSVPFailover Cluster: Setup and Validation Protocol (ClusPrep)msrpc/dcom/csvp34.0 None 11/21/2025
MS-DCOMDistributed Component Object Model (DCOM) Remote Protocolmsrpc/dcom25.0 None 9/16/2024
MS-DFSRHDFS Replication Helper Protocolmsrpc/dcom/dfsrh17.0 Major 4/23/2024
MS-DMRPDisk Management Remote Protocolmsrpc/dcom/dmrp8.2 None 6/1/2017
MS-FSRMFile Server Resource Manager Protocolmsrpc/dcom/fsrm36.0 Major 4/23/2024
MS-IISSIIS ServiceControl Protocolmsrpc/dcom/iiss12.0 Major 4/23/2024
MS-IMSAIIS IMSAdminBaseW Remote Protocolmsrpc/dcom/imsa16.0 Major 4/23/2024
MS-IOIIManagedObject Interface Protocolmsrpc/dcom/ioi20.0 Major 3/13/2019
MS-OAUTOLE Automation Protocolmsrpc/dcom/oaut21.0 Major 4/23/2024
MS-OCSPAMicrosoft OCSP Administration Protocolmsrpc/dcom/ocspa14.0 Major 8/11/2025
MS-PLAPerformance Logs and Alerts Protocolmsrpc/dcom/pla26.0 Major 4/23/2024
MS-RAIRemote Assistance Initiation Protocolmsrpc/dcom/rai12.0 Major 4/23/2024
MS-RDPESCRDP: Smart Card Virtual Channel Extensionmsrpc/dcom/rdpesc17.0 Major 4/23/2024
MS-RRASMRRAS Management Protocolmsrpc/dcom/rrasm26.0 Major 4/23/2024
MS-RSMPRemovable Storage Manager (RSM) Remote Protocolmsrpc/dcom/rsmp11.0 None 6/1/2017
MS-SCMPShadow Copy Management Protocolmsrpc/dcom/scmp10.0 Major 4/23/2024
MS-TPMVSCTPM Virtual Smart Card Remote Protocolmsrpc/dcom/tpmvsc8.0 Major 4/23/2024
MS-UAMGUpdate Agent Management Protocolmsrpc/dcom/uamg15.0 Major 9/9/2025
MS-VDSVirtual Disk Service (VDS) Protocolmsrpc/dcom/vds31.0 None 9/16/2024
MS-WCCEWindows Client Certificate Enrollment Protocolmsrpc/dcom/wcce53.0 Major 11/21/2025
MS-WMIOWMI Encoding Version 1.0 Protocolmsrpc/dcom/wmio18.0 Major 4/23/2024
MS-WMIWindows Management Instrumentation Remote Protocolmsrpc/dcom/wmi32.0 Major 4/23/2024
MS-WSRMWindows System Resource Manager (WSRM) Protocolmsrpc/dcom/wsrm14.2 None 6/1/2017

Other

SpecDescriptionPackage
MIMICOMMimikatz Command Interfacemsrpc/mimicom
MS-LCIDWindows Language Code Identifier (LCID) Referencemsrpc/lcid

Documentation

Generated code includes documentation pulled from the MSDN portal. Accuracy may vary due to inconsistencies in the upstream HTML source.

Open Questions

  • Why does IObjectExporter not support NDR64?
  • Why does the server return indistinguishable pointers for NDR64?
  • Why does SMB2 not support certain auth levels (e.g. Winreg supports only Insecure and Privacy)?

References

Contributing

Open an issue before submitting a PR. The project is still maturing and there are likely undiscovered bugs.