DCERPC binding strings
----------------------

When connecting to a dcerpc service you need to specify a binding
string.

The format is:

  TRANSPORT:host[flags]

where TRANSPORT is either ncacn_np for SMB or ncacn_ip_tcp for RPC/TCP

"host" is an IP or hostname or netbios name. If the binding string
identifies the server side of an endpoint, "host" may be an empty
string.

"flags" can include a SMB pipe name if using the ncacn_np transport or
a TCP port number if using the ncacn_ip_tcp transport, otherwise they
will be auto-determined.

other recognised flags are:

  sign      : enable ntlmssp signing
  seal      : enable ntlmssp sealing
  spnego    : use SPNEGO instead of NTLMSSP authentication
  krb5      : use KRB5 instead of NTLMSSP authentication
  connect   : enable rpc connect level auth (auth, but no sign or seal)
  validate  : enable the NDR validator
  print     : enable debugging of the packets
  bigendian : use bigendian RPC
  padcheck  : check reply data for non-zero pad bytes


Here are some examples:

   ncacn_np:myserver
   ncacn_np:myserver[samr]
   ncacn_np:myserver[\pipe\samr]
   ncacn_np:myserver[/pipe/samr]
   ncacn_np:myserver[samr,sign,print]
   ncacn_np:myserver[sign,spnego]
   ncacn_np:myserver[\pipe\samr,sign,seal,bigendian]
   ncacn_np:myserver[/pipe/samr,seal,validate]
   ncacn_np:
   ncacn_np:[/pipe/samr]
   ncacn_ip_tcp:myserver
   ncacn_ip_tcp:myserver[1024]
   ncacn_ip_tcp:myserver[sign,seal]
   ncacn_ip_tcp:myserver[spnego,seal]


IDEA: Maybe extend UNC names like this?

 smbclient //server/share
 smbclient //server/share[sign,seal,spnego]