{"record":{"id":"47799eb2894b1a7f","repo":"projectdiscovery/nuclei","slug":"svcctl-open-scm-w","errorCode":null,"errorMessage":"svcctl open scm: %w","messagePattern":"svcctl open scm: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/dcerpc.go","lineNumber":335,"sourceCode":"\tif err := c.connect(); err != nil {\n\t\treturn nil, err\n\t}\n\n\tpf, err := c.smb.OpenPipe(\"svcctl\")\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"open svcctl pipe: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = pf.Close()\n\t}()\n\n\trpc := gprpc.NewClient(pf)\n\tif err := rpc.Bind(gpsvcctl.UUID, gpsvcctl.MajorVersion, gpsvcctl.MinorVersion); err != nil {\n\t\treturn nil, fmt.Errorf(\"svcctl bind: %w\", err)\n\t}\n\tsc, err := gpsvcctl.NewServiceController(rpc)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"svcctl open scm: %w\", err)\n\t}\n\tdefer sc.Close()\n\n\tres, err := gpsmbexec.Exec(sc, c.smb, command, gpsmbexec.Options{\n\t\tShare:   share,\n\t\tMode:    gpsmbexec.ModeShare,\n\t\tTimeout: 10 * time.Second,\n\t})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn &SmbExecResult{ServiceName: res.ServiceName, Output: res.Output}, nil\n}\n\n\n// AtExecResult is returned by AtExec.\ntype AtExecResult struct {\n\tTaskName string `json:\"task_name\"`","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/dcerpc.go#L317-L353","documentation":"gpsvcctl.NewServiceController(rpc) — effectively OpenSCManagerW — failed inside SmbExec. The classic access-denied: opening the Service Control Manager with the required rights needs local admin; also triggered by Remote UAC filtering elevated tokens of local (non-built-in) admin accounts over the network unless LocalAccountTokenFilterPolicy is 1.","triggerScenarios":"SmbExec with a non-admin account (ERROR_ACCESS_DENIED from OpenSCManagerW), or local-admin credentials on a client SKU where Remote UAC strips the admin token.","commonSituations":"Reused local-admin credentials on workstations hitting LocalAccountTokenFilterPolicy; domain users added to local Administrators; scans assuming admin but running as normal user.","solutions":["Authenticate as (domain) administrator for the target.","For local accounts, set LocalAccountTokenFilterPolicy=1 on the target or use the built-in Administrator (RID 500) account.","Verify remotely with 'sc \\\\host query' from a Windows box to confirm SCM rights.","If admin is impossible, choose a module with lower requirements (WMI needs admin too — consider read-only enumeration instead)."],"exampleFix":"// before\nconst c = new dcerpc.Client('wk01', 'ACME', 'localuser', 'pass');\nc.SmbExec('whoami', 'ADMIN$'); // svcctl open scm: ACCESS_DENIED\n\n// after\nconst c = new dcerpc.Client('wk01', 'ACME', 'Administrator', 'adm-pass'); // admin or RID-500\nc.SmbExec('whoami', 'ADMIN$');","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const r = c.SmbExec(cmd, 'ADMIN$');\n} catch (e) {\n  const msg = String(e);\n  if (msg.includes('svcctl open scm')) {\n    // OpenSCManagerW denied: not admin, or Remote UAC filtering the token\n    log('SCM access denied — admin rights required: ' + msg);\n  } else throw e;\n}","preventionTips":["Require administrator credentials for SCM-based execution in template assumptions.","For local accounts, plan around LocalAccountTokenFilterPolicy or use the RID-500 account.","Pre-verify SCM rights with 'sc \\\\host query' from a controlled Windows host."],"tags":["scm","svcctl","uac","windows","privileges"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}