{"record":{"id":"1b9624c421045cd9","repo":"projectdiscovery/nuclei","slug":"svcctl-bind-w","errorCode":null,"errorMessage":"svcctl bind: %w","messagePattern":"svcctl bind: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/dcerpc.go","lineNumber":331,"sourceCode":"\tc.nj.Require(command != \"\", \"command cannot be empty\")\n\tif !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {\n\t\treturn nil, protocolstate.ErrHostDenied.Msgf(c.Host)\n\t}\n\tif err := c.connect(); err != nil {\n\t\treturn nil, err\n\t}\n\n\tpf, err := c.smb.OpenPipe(\"svcctl\")\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"open svcctl pipe: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = pf.Close()\n\t}()\n\n\trpc := gprpc.NewClient(pf)\n\tif err := rpc.Bind(gpsvcctl.UUID, gpsvcctl.MajorVersion, gpsvcctl.MinorVersion); err != nil {\n\t\treturn nil, fmt.Errorf(\"svcctl bind: %w\", err)\n\t}\n\tsc, err := gpsvcctl.NewServiceController(rpc)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"svcctl open scm: %w\", err)\n\t}\n\tdefer sc.Close()\n\n\tres, err := gpsmbexec.Exec(sc, c.smb, command, gpsmbexec.Options{\n\t\tShare:   share,\n\t\tMode:    gpsmbexec.ModeShare,\n\t\tTimeout: 10 * time.Second,\n\t})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn &SmbExecResult{ServiceName: res.ServiceName, Output: res.Output}, nil\n}\n","sourceCodeStart":313,"sourceCodeEnd":349,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/dcerpc.go#L313-L349","documentation":"In SmbExec, after svcctl opened, the (unauthenticated) rpc.Bind to the SVCCTL interface failed. Rare: the pipe accepted the open but the DCE/RPC bind exchange failed — usually a security product intercepting the pipe, a non-Microsoft SMB stack answering opens without a real RPC endpoint behind them, or a transient reset mid-bind.","triggerScenarios":"SmbExec on hosts fronted by pipe-inspecting EDR or SMB proxies; malformed stacks that complete SMB opens but not RPC binds; connection reset between open and bind.","commonSituations":"EDR/IPS tampering with DCE/RPC-over-SMB; Samba servers with mismatched pipe aliases.","solutions":["Check whether classic psexec / 'sc \\\\host query' works to isolate whether SCM over the pipe functions at all.","Retry once for transient resets.","Try AtExec (atsvc + Task Scheduler) as an alternate execution path.","Inspect EDR posture on the target."],"exampleFix":"// before\nc.SmbExec('whoami', 'ADMIN$'); // svcctl bind: ...\n\n// after (alternate exec path on svcctl bind failure)\ntry {\n  c.SmbExec('whoami', 'ADMIN$');\n} catch (e) {\n  if (String(e).includes('svcctl bind')) {\n    c.AtExec('whoami', 'C$'); // tsch over atsvc instead\n  } else throw e;\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const r = c.SmbExec(cmd, 'ADMIN$');\n} catch (e) {\n  const msg = String(e);\n  if (msg.includes('svcctl bind')) {\n    // pipe open but RPC bind failed: middleware/EDR or broken stack\n    c.AtExec(cmd, 'C$'); // alternate path\n  } else throw e;\n}","preventionTips":["Isolate middleware interference by testing classic psexec behavior on the host.","Treat bind failures after successful opens as a signal of interception, not credentials.","Retry once before concluding the path is unusable."],"tags":["svcctl","dcerpc","bind","smb","edr"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}