PowerShell: Check RPC Services on Remote Windows Machines

$computernames='SERVER1','SERVER2'
$tests=@(
    #[PSCustomObject] @{protocol='tcp';port=22},
    #[PSCustomObject] @{protocol='tcp';port=80},

    # RPC client-server communication
    [PSCustomObject] @{protocol='tcp';port=135},

    # SMB / CIFS Protocol
    [PSCustomObject] @{protocol='udp';port=137},
    [PSCustomObject] @{protocol='udp';port=138},
    [PSCustomObject] @{protocol='tcp';port=139},
    [PSCustomObject] @{protocol='tcp';port=445},
    [PSCustomObject] @{protocol='tcp';port=5985}, 
    # Dynamic port range
    [PSCustomObject] @{protocol='tcp';port=49152},
    [PSCustomObject] @{protocol='tcp';port=65535}

    # [PSCustomObject] @{protocol='tcp';port=623},
    # [PSCustomObject] @{protocol='tcp';port=1433},      
    # [PSCustomObject] @{protocol='tcp';port=5986},
    # [PSCustomObject] @{protocol='tcp';port=8530},
    # [PSCustomObject] @{protocol='tcp';port=8531},
    # [PSCustomObject] @{protocol='tcp';port=8100},
    # [PSCustomObject] @{protocol='tcp';port=8102},
    )

function checkPort($computername=$env:computername,$port=135,$protocol='tcp',$verbose=$false){
    function includePortQry{
        if (!(Get-Command portqry.exe -ErrorAction SilentlyContinue)){
            if (!(Get-Command choco.exe -ErrorAction SilentlyContinue)) {
            Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))}
            choco install portqry -y
            if (Get-Command portqry.exe -ErrorAction SilentlyContinue){return $true}else{return $false}
        }else{
            return $true
        }
    }
    
    $portQryExists=includePortQry
    if($portQryExists){        
        $ip=[System.Net.Dns]::GetHostAddresses($computername).IPAddressToString|select-object -first 1
        $reachable=if($port -ne 135){[bool](portqry -n $ip -p $protocol -e $port|find ': LISTENING')
            }else{
                [bool](portqry -n $ip -p $protocol -e $port|find 'Total endpoints found: ')
            }       
        if($verbose){write-host "$port/$protocol : $reachable"}
        $result=[PSCustomObject]@{
            source=$env:computername
            destination=$computername
            port=$port
            protocol=$protocol
            reachable=$reachable
        }
    }else{
        write-warning 'Unable to proceed without PortQry'
        return $null
    }
    return $result
}

$results=@()
foreach ($computername in $computernames){
    write-host "Checking $computername"
    foreach($test in $tests){
        $port=$test.Port
        $protocol=$test.Protocol
        $result=checkPort $computername $port $protocol
        $results+=$result
    }
}
$results|ft -wrap

$remoteComputer=testmachine.kimconnect.com

function checkPort{
    Param(
        [string]$server,
        [int]$port=135,
        [bool]$verbose=$true
        )
 
        function importPortQry{
            if (!(Get-Command portqry.exe -ErrorAction SilentlyContinue)){
                if (!(Get-Command choco.exe -ErrorAction SilentlyContinue)) {
                Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))}
                choco install portqry -y
                if (Get-Command portqry.exe -ErrorAction SilentlyContinue){return $true}else{return $false}
            }else{
                return $true
            }
        }
         function Check-NetConnection($server, $port) {
            $session = New-Object System.Net.Sockets.TcpClient;
            $result=$false
            try {
                $session.Connect($server, $port);
                $result=$true;
            } catch {
                $result=$false;
            } finally {
                $session.Close();
                
            }
            return $result;
        }        

    function testPortArray {
        # Casting parameters is better than passing arguments as that allows for switches that can be arranged in any order
        param ([string]$targetServer,[array]$arrPorts,$verbose=$false)
        $source = $env:computername
        $destination=$targetServer.toUpper()
        $portsCount=$arrPorts.count
        $portsSuccess=0

        foreach ($port in $arrPorts){        
            $testResult = Check-NetConnection -server $targetServer -port $port;
            If ($testResult){
                if($verbose){Write-Output "$port`: reachable"}
                $portsSuccess++
                }
            Else{
                if($verbose){Write-Output "$port`: unreachable"}
                }
        }

        if($portsCount -eq $portsSuccess){
            return $true
        }else{
            return $false
        }

    }
     
    if($verbose){write-host "Checking for existence of PortQry.exe..."}
    do {
        $portQryExists=Get-Command "PortQry.exe" -ErrorAction SilentlyContinue
        if(!$portQryExists){
            importPortQry;
            sleep 1;
        }
    }while(!$portQryExists)

    $portReachable=Check-NetConnection -server $server -port $port     
    if ($portReachable){
        if($verbose){write-host "$env:computername is able to reach $server on the primary port of $port."}
        $strInvokeCommand = "PortQry.exe -e $port -n $server";
        $arrQuryResult = Invoke-Expression $strInvokeCommand;
     
        $arrPorts = @();    #Initiates and clears the collection of ports array
        ForEach ($strResult in $arrQuryResult)
        {
          If ($strResult.Contains("ip_tcp"))
          {
          $arrSplt = $strResult.Split("[");
          $strPort = $arrSplt[1];
          $strPort = $strPort.Replace("]","");
          $arrPorts += $strPort;
          }
        }
 
        #  Remove duplicate port records from within the array
        $arrPorts = $arrPorts | select -uniq
        if ($arrPorts){            
            if($verbose){write-host "These are the detected dynamic ephemeral ports being used:`r`n$arrPorts"  }      
            $result=testPortArray -targetServer $server -arrPorts $arrPorts #  Pass the ports array into the workflow as a parameter
            return $result
        }else{
            if($verbose){write-host "Ephemeral ports were NOT detected.`r`n"}
                return $portReachable
                }
    }else{
        if($verbose){write-host "$env:computername is NOT able to reach $server on port: $port`r`n"}
        return $false
        }
}

checkPort -server $remoteComputer -port 135

function importPortQry{
    if (Get-Command portqry.exe -ErrorAction SilentlyContinue){
        if (!(Get-Command choco.exe -ErrorAction SilentlyContinue)) {
        Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))}
        choco install portqry -y | out-null
        if (Get-Command portqry.exe -ErrorAction SilentlyContinue){return $true}else{return $false}
        }else{
        return $false;
        }
}

function Check-NetConnection($server, $port) {
    $session = New-Object System.Net.Sockets.TcpClient;
    $result=$false
    try {
        $session.Connect($server, $port);
        $result=$true;
    } catch {
        $result=$false;
    } finally {
        $session.Close();
       
    }
    return $result;
}

function testPort{
    Param(
        [string]$server,
        [int]$port=135
        )
    
    # using a workflow to test each ports in the array
    workflow testPortArray {
        # Casting parameters is better than passing arguments as that allows for switches that can be arranged in any order
        param ([string]$targetServer,[array]$arrPorts)
        $source = $env:computername
        $destination=$targetServer.toUpper()
                      
        # Test all ports using multi-threaded sessions to save time      
        foreach -parallel ($port in $arrPorts){        
            $testResult = Check-NetConnection -server $targetServer -port $port;
            If ($testResult){
                Write-Output "$port`: reachable"
                }
            Else{
                Write-Output "$port`: unreachable"
                }
        }
    }
    
    #  Check for existence of PortQry.exe
    $portQryExists=Get-Command "PortQry.exe" -ErrorAction SilentlyContinue
    while (!($portQryExists)){
        importPortQry;
        sleep 1;
        $portQryExists #refreshes the Get-Command query
        }
    $reachable=Check-NetConnection -server $server -port $port
    
    if ($reachable){
        write-host "$env:computername is able to reach $server on the primary port of $port.`r`n"
        $strInvokeCommand = "PortQry.exe -e $port -n $server";
        $arrQuryResult = Invoke-Expression $strInvokeCommand;
    
        $arrPorts = @();    #Initiates and clears the collection of ports array
        ForEach ($strResult in $arrQuryResult)
        {
          If ($strResult.Contains("ip_tcp"))
          {
          $arrSplt = $strResult.Split("[");
          $strPort = $arrSplt[1];
          $strPort = $strPort.Replace("]","");
          $arrPorts += $strPort;
          }
        }

        #  Remove duplicate port records from within the array
        $arrPorts = $arrPorts | select -uniq
        if ($arrPorts){            
            write-host "These are the detected dynamic ephemeral ports being used:`r`n$arrPorts"        
            testPortArray -targetServer $server -arrPorts $arrPorts #  Pass the ports array into the workflow as a parameter
            }else{
                write-host "Ephemeral ports were NOT detected.`r`n"
                }

        }else{
            write-host "$env:computername is NOT able to reach $server on port: $port`r`n"
            }
}

testPort -server honeypot.kimconnect.com -port 135

<# Sample Output:
JUMPBOX is able to reach HONEYPOT on the primary port of 135.

These are the detected dynamic ephemeral ports being used:
49664 55321 55281 49672 49670 49669 49668 49667 49673 49666 49665
49665: reachable
49667: reachable
49666: reachable
49673: reachable
49669: reachable
49668: reachable
49670: reachable
55281: reachable
49672: reachable
55321: reachable
49664: reachable
#>