{"record":{"id":"3373757274debb7a","repo":"projectdiscovery/nuclei","slug":"open-lsass-pipe-w","errorCode":null,"errorMessage":"open lsass pipe: %w","messagePattern":"open lsass pipe: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/secretsdump/secretsdump.go","lineNumber":123,"sourceCode":"// ```\nfunc (c *Client) DCSync(target string) (*Secret, error) {\n\tc.nj.Require(target != \"\", \"target cannot be empty\")\n\tif !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {\n\t\treturn nil, protocolstate.ErrHostDenied.Msgf(c.Host)\n\t}\n\n\tsmb := gpsmb.NewClient(c.target, c.creds)\n\tif err := smb.Connect(); err != nil {\n\t\treturn nil, fmt.Errorf(\"smb connect: %w\", err)\n\t}\n\tdefer smb.Close()\n\n\tpipe, err := smb.OpenPipe(\"\\\\PIPE\\\\lsass\")\n\tif err != nil {\n\t\t// Fall back to drsuapi-named pipe; both are accepted by the DC.\n\t\tpipe, err = smb.OpenPipe(\"lsass\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"open lsass pipe: %w\", err)\n\t\t}\n\t}\n\trpc := gprpc.NewClient(pipe)\n\tif err := rpc.BindAuth(gpdrs.UUID, gpdrs.MajorVersion, gpdrs.MinorVersion, c.creds); err != nil {\n\t\treturn nil, fmt.Errorf(\"drsuapi bind: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = rpc.Transport.Close()\n\t}()\n\n\tbind, err := gpdrs.DsBind(rpc)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds bind: %w\", err)\n\t}\n\n\tdcInfo, err := gpdrs.DsDomainControllerInfo(rpc, bind.Handle, c.Domain)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds dc info: %w\", err)","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/secretsdump/secretsdump.go#L105-L141","documentation":"DCSync needs the DRSUAPI RPC endpoint reachable over an SMB named pipe. The code opens \\\\PIPE\\\\lsass and falls back to the short form 'lsass'; if both fail, no RPC transport exists. The usual causes are that the target is not a domain controller, the authenticated session is denied access to the pipe, or DC hardening removed the endpoint.","triggerScenarios":"Running DCSync against a member server or workstation instead of a DC; authenticating with a low-privilege or machine-local account; DC hardened (EDR/SMB hardening) so lsass pipe opens are rejected; connecting to a legacy Samba DC that does not expose the pipe.","commonSituations":"Target list contains non-DC hosts; local account used instead of a domain account; security tooling on the DC blocking named-pipe access; wrong port assumptions (IPC$ not available).","solutions":["Confirm the target is actually a domain controller (ports 88/389/445, SPN LDAP/DC records, nltest /dsgetdc:domain)","Re-run with a Domain Admin or replication-privileged domain account","Use the DC's FQDN so the pipe resolves on the correct host","Check DC/EDR hardening that restricts named pipes (e.g. RestrictNamedPipeAccess style controls)"],"exampleFix":"// before\nconst c = new sd.Client('fileserver01', 'acme.local', 'admin', 'P@ss'); // not a DC\nconst s = c.DCSync('krbtgt'); // open lsass pipe: ...\n\n// after\nconst c = new sd.Client('dc01.acme.local', 'acme.local', 'admin', 'P@ss');\nconst s = c.DCSync('krbtgt');","handlingStrategy":"try-catch","validationCode":"// Only attempt DCSync against confirmed DCs (LDAP/88/389 open, GC on 3268)\nif !portOpen(dc, 88) || !portOpen(dc, 389) { return errors.New(\"target is not a DC\") }","typeGuard":null,"tryCatchPattern":"secret, err := c.DCSync(target)\nif err != nil && strings.Contains(err.Error(), \"open lsass pipe:\") {\n    // wrong host class or hardened DC: do not retry the same host\n    log.Printf(\"%s exposes no DRSUAPI pipe; skipping\", c.Host)\n    return nil // treat as soft-skip in recon flows\n}","preventionTips":["Enumerate DCs first (DNS SRV _ldap._tcp, port 389/88 checks) and only DCSync those","Authenticate as a domain principal, never a local account","Treat pipe-open failure on a known DC as a hardening signal, not a transient error"],"tags":["smb","dcsync","named-pipe","rpc","active-directory"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}