{"record":{"id":"958448ddaa74ce66","repo":"projectdiscovery/nuclei","slug":"smb-connect-w","errorCode":null,"errorMessage":"smb connect: %w","messagePattern":"smb connect: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/dcerpc.go","lineNumber":164,"sourceCode":"func (c *Client) SetPort(port int) {\n\tc.Port = port\n\tc.target.Port = port\n}\n\n// connect lazily establishes the underlying SMB session that all RPC\n// transports are tunneled through. The SMB Client is bound to a Dialer that\n// captures this client's executionId so every dial inside goimpacket is\n// validated against the same network policy.\nfunc (c *Client) connect() error {\n\tif c.started {\n\t\treturn nil\n\t}\n\tif !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {\n\t\treturn protocolstate.ErrHostDenied.Msgf(c.Host)\n\t}\n\tc.smb = gpsmb.NewClientWithDialer(c.target, c.creds, NewExecDialer(c.nj.ExecutionId()))\n\tif err := c.smb.Connect(); err != nil {\n\t\treturn fmt.Errorf(\"smb connect: %w\", err)\n\t}\n\tc.started = true\n\treturn nil\n}\n\n// Close releases the underlying SMB session.\nfunc (c *Client) Close() {\n\tif c.smb != nil {\n\t\tc.smb.Close()\n\t}\n\tc.started = false\n}\n\n// rpcOverNamedPipe binds the supplied interface UUID over a named pipe and\n// returns an authenticated *dcerpc.Client.\nfunc (c *Client) rpcOverNamedPipe(pipe string, uuid [16]byte, major, minor uint16) (*gprpc.Client, error) {\n\tif err := c.connect(); err != nil {\n\t\treturn nil, err","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/dcerpc.go#L146-L182","documentation":"The DCERPC/SMB JS client could not establish its SMB session: connect() first verifies the host against protocolstate's network policy (a denied host fails earlier with ErrHostDenied, not this), then dials via goimpacket's SMB client bound to an execution-scoped dialer; any failure of smb.Connect() is wrapped as 'smb connect: ...'. The %w preserves goimpacket's error: unreachable host, auth failure, or protocol/signing mismatch.","triggerScenarios":"new dcerpc-style Client connect where tcp/445 is filtered or the service is down, credentials are wrong (NTLM hash/password/username), SMB signing is required but not negotiated, or the target speaks only SMB1.","commonSituations":"Templates binding to 445 against hosts exposing SMB only on 139; domain-credential formats wrong (user vs DOMAIN\\user); firewalls dropping 445 mid-scan; NAT'd lab targets.","solutions":["Verify reachability of 445: nc -vz host 445 (or test on 139 and configure accordingly)","Correct the credential format — for domain accounts use DOMAIN\\\\user with lm/ntlm hashes where expected","Confirm the SMB dialect: targets requiring SMB1 are unsupported by modern clients; enforce signing compatible settings","Remember connect() is idempotent (c.started guard): a failed connect leaves started=false so you may retry after fixing the cause, but call Close() if you abandon the client"],"exampleFix":"// before\nconst c = new Client({ Host: '10.0.0.5', User: 'admin', Hash: '...' });\nawait c.connect();  // smb connect: ... (445 filtered)\n\n// after\n// firewall allows 445, domain-qualified user\nconst c = new Client({ Host: '10.0.0.5', User: 'CORP\\\\admin', Hash: 'aad3b435b51404eeaad3b435b51404ee:...' });\nawait c.connect();","handlingStrategy":"try-catch","validationCode":"// in template JS: cheap reachability probe before SMB connect\nconst ok = await wireguard('tcp', Host, 445); // or a raw TCP dial helper if available\nif (!ok) { log('445 closed — skip'); exit(); }","typeGuard":null,"tryCatchPattern":"Wrap the connect/usage sequence in try/catch; on 'smb connect:' inspect the wrapped goimpacket error — timeout/unreachable means network (skip host), STATUS_LOGON_FAILURE means credentials (fix creds), STATUS_ACCESS_DENIED means signing/permission config. Call Close() on failure so a later connect() may retry (started is reset).","preventionTips":["Confirm tcp/445 (or 139) is reachable before running SMB templates","Use DOMAIN\\\\user form and correct lm:ntlm hash format for domain accounts","Keep hosts allowlisted in protocolstate policy; denied hosts fail earlier with ErrHostDenied","Do not reuse one Client across targets — connect() is guarded by c.started per client"],"tags":["network","smb","dcerpc","javascript","authentication"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}