rpcclient

Connect to a remote host

$ rpcclient -U domain\username%password ip_address

$ rpcclient -U username -W domain -N ip_address

$ rpcclient -U domain\username --pw-nt-hash ip_address

$ rpcclient -U domain\username%password -c "command1;command2" ip_address

$ rpcclient $> enumdomusers

$ rpcclient $> queryuser username

$ rpcclient $> createdomuser username

rpcclient [options] server

rpcclient is an MS-RPC client tool from the Samba suite. It allows executing RPC commands against Windows systems and Samba servers for user management, enumeration, and administration.
Interactive mode provides a shell for executing RPC commands like enumdomusers, queryuser, and createdomuser.

-U, --user user

Username for authentication (domain\user%password format)

Workgroup or domain name

Connect without password

Password is an NT hash

Execute semicolon-separated commands

Requires proper credentials for most operations. Some commands require administrator privileges on the target system.

Part of Samba suite, providing Windows interoperability tools for Unix systems.

smbclient(1), net(8)