{"record":{"id":"0923107f4086cdd9","repo":"projectdiscovery/nuclei","slug":"tsch-bind-w","errorCode":null,"errorMessage":"tsch bind: %w","messagePattern":"tsch bind: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/dcerpc.go","lineNumber":394,"sourceCode":"// ```\nfunc (c *Client) AtExec(command, share string) (*AtExecResult, error) {\n\tc.nj.Require(command != \"\", \"command cannot be empty\")\n\tif !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {\n\t\treturn nil, protocolstate.ErrHostDenied.Msgf(c.Host)\n\t}\n\tif err := c.connect(); err != nil {\n\t\treturn nil, err\n\t}\n\n\tpf, err := c.smb.OpenPipe(\"atsvc\")\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"open atsvc pipe: %w\", err)\n\t}\n\tdefer func() { _ = pf.Close() }()\n\n\trpc := gprpc.NewClient(pf)\n\tif err := rpc.BindAuth(gptsch.UUID, gptsch.MajorVersion, gptsch.MinorVersion, c.creds); err != nil {\n\t\treturn nil, fmt.Errorf(\"tsch bind: %w\", err)\n\t}\n\tts := gptsch.NewTaskScheduler(rpc)\n\n\tres, err := gpatexec.Exec(ts, c.smb, command, gpatexec.Options{\n\t\tShare:     share,\n\t\tTimeout:   15 * time.Second,\n\t\tSessionID: -1,\n\t})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn &AtExecResult{TaskName: res.TaskName, Output: res.Output}, nil\n}\n\n// SmbListShares enumerates the SMB shares exposed by the target.\n//\n// @example\n// ```javascript","sourceCodeStart":376,"sourceCodeEnd":412,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/dcerpc.go#L376-L412","documentation":"After atsvc opened, rpc.BindAuth to the Task Scheduler (tsch) interface failed — the authenticated bind was rejected: invalid credentials inside the altered bind, the SchRpc interface not served, or Kerberos problems (time skew, KDC unreachable) after SetKerberos(). Distinct from 212: the pipe exists; the bind/auth exchange failed.","triggerScenarios":"AtExec with a wrong password producing a bind-time logon failure, a wrong domain string, or SetKerberos with skewed clocks / unreachable DC.","commonSituations":"Credential typos only surfacing at RPC bind (SMB allowed the session via different flags); NTLM-disabled environments; Kerberos environments with NTP drift.","solutions":["Verify credentials with a known-good hash via SetHash().","Check the domain string and clock sync when Kerberos is enabled.","Confirm the Task Scheduler service and atsvc endpoint with RpcDump.","Fall back to SmbExec if tsch refuses binds."],"exampleFix":"// before\nconst c = new dcerpc.Client('dc01', 'ACME', 'adm', 'bad-pass');\nc.AtExec('whoami', 'C$'); // tsch bind: STATUS_LOGON_FAILURE\n\n// after\nconst c = new dcerpc.Client('dc01', 'ACME', 'adm', '');\nc.SetHash('aad3b435b51404eeaad3b435b51404ee:<valid-nt>');\nc.AtExec('whoami', 'C$');","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const r = c.AtExec(cmd, 'C$');\n} catch (e) {\n  const msg = String(e);\n  if (msg.includes('tsch bind')) {\n    // authenticated bind to Task Scheduler rejected: credential/Kerberos issue\n    log('tsch bind rejected: ' + msg);\n  } else throw e;\n}","preventionTips":["Validate credentials with SetHash() using a known-good NT hash.","Keep clocks synced when using Kerberos; prefer hash auth in scan contexts.","Confirm the atsvc endpoint serves SchRpc via RpcDump."],"tags":["tsch","atexec","authentication","kerberos","dcerpc"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}