{"record":{"id":"2642282a9940bc86","repo":"projectdiscovery/nuclei","slug":"drsuapi-bind-w","errorCode":null,"errorMessage":"drsuapi bind: %w","messagePattern":"drsuapi bind: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/secretsdump/secretsdump.go","lineNumber":128,"sourceCode":"\t}\n\n\tsmb := gpsmb.NewClient(c.target, c.creds)\n\tif err := smb.Connect(); err != nil {\n\t\treturn nil, fmt.Errorf(\"smb connect: %w\", err)\n\t}\n\tdefer smb.Close()\n\n\tpipe, err := smb.OpenPipe(\"\\\\PIPE\\\\lsass\")\n\tif err != nil {\n\t\t// Fall back to drsuapi-named pipe; both are accepted by the DC.\n\t\tpipe, err = smb.OpenPipe(\"lsass\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"open lsass pipe: %w\", err)\n\t\t}\n\t}\n\trpc := gprpc.NewClient(pipe)\n\tif err := rpc.BindAuth(gpdrs.UUID, gpdrs.MajorVersion, gpdrs.MinorVersion, c.creds); err != nil {\n\t\treturn nil, fmt.Errorf(\"drsuapi bind: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = rpc.Transport.Close()\n\t}()\n\n\tbind, err := gpdrs.DsBind(rpc)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds bind: %w\", err)\n\t}\n\n\tdcInfo, err := gpdrs.DsDomainControllerInfo(rpc, bind.Handle, c.Domain)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds dc info: %w\", err)\n\t}\n\n\tdomainDN, err := gpdrs.GetDomainDN(rpc, bind.Handle, c.Domain)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds domain dn: %w\", err)","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/secretsdump/secretsdump.go#L110-L146","documentation":"After opening the lsass pipe, the code creates an RPC client and binds to the DRSUAPI interface (UUID + version) with explicit credentials via BindAuth. This error means the bind or its authentication layer was rejected: the DC refused the auth context (bad creds at RPC level, signing mismatch) or NACKed the DRSUAPI interface.","triggerScenarios":"rpc.BindAuth(gpdrs.UUID, ...) fails because credentials are invalid, the connection requires SMB signing that was not negotiated, or the endpoint does not host DRSUAPI (non-DC again, or drsuapi disabled).","commonSituations":"Password correct for SMB session but wrong domain prefix in creds; DC enforces RPC privacy/signing the client cannot satisfy; pass-the-hash given in a malformed format.","solutions":["Re-verify the domain\\\\user form and password used to construct the Client","If using a hash, call SetHash(':<nthash>') with the LM:NTHash colon format","Confirm the target hosts DRSUAPI (it must be a DC)","Check whether DC policy requires Kerberos-only for DRSUAPI binds"],"exampleFix":"// before\nconst c = new sd.Client('dc01', 'acme.local', 'admin', 'P@ss');\nc.SetHash('31d6cfe0d16ae931b73c59d7e0c089c0'); // missing leading colon -> drsuapi bind fails\n\n// after\nc.SetHash(':31d6cfe0d16ae931b73c59d7e0c089c0');","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := c.DCSyncRaw(); err != nil { // conceptual\n    if strings.Contains(err.Error(), \"drsuapi bind:\") {\n        // auth at RPC layer: re-check creds/hash format before retrying\n        c.SetHash(\":\" + nthash)\n    }\n}","preventionTips":["Use the DOMAIN\\\\user convention consistently for the Client constructor","Pass hashes in LM:NTHash format with the leading colon when using SetHash","Confirm the DC allows NTLM for DRSUAPI; switch to an account/domain that does"],"tags":["rpc","dcerpc","drsuapi","authentication","dcsync"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}