

[root@localhost src]# ./msrpcfuzz 10.25.25.15 135 e1af8308-5d1f-11c9-91a4-08002b14a0fa 8a885d04-1ceb-11c9-9fe8-08002b104860 3 2 3 20000 13
Target is 10.25.25.15
Hitting function number 3
Initialized random with 1231
Try Number 1109 Pushing 10 things.
Interesting - server closed socket!



./msrpcfuzz 10.25.25.15 1026 3919286a-b10c-11d0-9ba8-00c04fd92ef5 8a885d04-1ceb-11c9-9fe8-08002b104860 0 2 4 10000 25

Binding: ncacn_ip_tcp:10.25.25.15[1026]
RpcMgmtInqIfIds succeeded
Interfaces: 11
  12345778-1234-abcd-ef00-0123456789ab v0.0
  c681d488-d850-11d0-8c52-00c04fd90f7e v1.0
  3919286a-b10c-11d0-9ba8-00c04fd92ef5 v0.0
  12345778-1234-abcd-ef00-0123456789ac v1.0
  ecec0d70-a603-11d0-96b1-00a0c91ece30 v1.0
  16e0cf3a-a604-11d0-96b1-00a0c91ece30 v1.0
  e3514235-4b06-11d1-ab04-00c04fc2dcd2 v4.0
  f5cc5a7c-4264-101a-8c59-08002b2f8426 v21.0
  12345678-1234-abcd-ef00-01234567cffb v1.0
  d335b8f6-cb31-11d0-b0f9-006097ba4e54 v1.5
  98fe2c90-a542-11d0-a4ef-00a0c9062910 v1.0

Basically, go to the listing from bindview's tool, take the interface
and port and use the 8a88 interface and version number from that and 
there you go.
-dave

