{"record":{"id":"9e9e98eea175c320","repo":"projectdiscovery/nuclei","slug":"could-not-resolve-q-to-a-dn","errorCode":null,"errorMessage":"could not resolve %q to a DN","messagePattern":"could not resolve %q to a DN","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/secretsdump/secretsdump.go","lineNumber":156,"sourceCode":"\n\tdcInfo, err := gpdrs.DsDomainControllerInfo(rpc, bind.Handle, c.Domain)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds dc info: %w\", err)\n\t}\n\n\tdomainDN, err := gpdrs.GetDomainDN(rpc, bind.Handle, c.Domain)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds domain dn: %w\", err)\n\t}\n\n\t// Resolve target -> DN if it doesn't already look like one.\n\tuserDN := target\n\tif len(target) < 3 || (target[:3] != \"CN=\" && target[:3] != \"cn=\") {\n\t\tcracked, err := gpdrs.DsCrackNames(rpc, bind.Handle, 7 /* DS_NT4_ACCOUNT_NAME */, 1 /* DS_FQDN_1779_NAME */, []string{c.Domain + \"\\\\\" + target})\n\t\tif err != nil || len(cracked) == 0 || cracked[0].Name == \"\" {\n\t\t\tcracked, err = gpdrs.DsCrackNames(rpc, bind.Handle, 11 /* DS_UNIQUE_ID_NAME (SID) */, 1, []string{target})\n\t\t\tif err != nil || len(cracked) == 0 || cracked[0].Name == \"\" {\n\t\t\t\treturn nil, fmt.Errorf(\"could not resolve %q to a DN\", target)\n\t\t\t}\n\t\t}\n\t\tuserDN = cracked[0].Name\n\t}\n\n\tres, err := gpdrs.DsGetNCChanges(rpc, bind.Handle, domainDN, userDN, dcInfo.NtdsDsaObjectGuid, rpc.GetSessionKey())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"DsGetNCChanges: %w\", err)\n\t}\n\tif len(res.Objects) == 0 {\n\t\treturn nil, fmt.Errorf(\"DsGetNCChanges returned no objects\")\n\t}\n\to := res.Objects[0]\n\tout := &Secret{\n\t\tSAMAccountName:     o.SAMAccountName,\n\t\tDistinguishedName:  o.DN,\n\t\tRID:                o.RID,\n\t\tNTHash:             hex.EncodeToString(o.NTHash),","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/secretsdump/secretsdump.go#L138-L174","documentation":"DCSync's target must resolve to a distinguished name. If the argument does not already start with CN=, the code cracks it twice: first as an NT4 account name (DOMAIN\\\\user) and then as a SID. If both DsCrackNames attempts fail or return an empty name, the target does not exist (or cannot be cracked by this principal) and this error is returned.","triggerScenarios":"DCSync('Admistrator') with a typo; DCSync('user@acme.local') — a UPN is neither the NT4 sAMAccountName form nor a SID; account lives in another trusted domain; caller lacks rights to crack names.","commonSituations":"UPN passed where sAMAccountName is expected; usernames harvested from email addresses; deleted or renamed accounts.","solutions":["Pass the exact sAMAccountName, e.g. DCSync('krbtgt')","Or pass the full DN directly: DCSync('CN=Administrator,CN=Users,DC=acme,DC=local')","Or pass the objectSid: DCSync('S-1-5-21-...-500')","Verify the account exists with an LDAP search before syncing"],"exampleFix":"// before\nconst s = c.DCSync('administrator@acme.local'); // UPN form cannot be cracked\n\n// after\nconst s = c.DCSync('Administrator');","handlingStrategy":"validation","validationCode":"// Resolve or verify the target before DCSync\nif !strings.HasPrefix(target, \"CN=\") && !strings.HasPrefix(target, \"S-1-\") {\n    // will be cracked as DOMAIN\\\\sAMAccountName — confirm it exists via LDAP first\n    if !samExists(dc, domain, target) {\n        return fmt.Errorf(\"target %q does not exist\", target)\n    }\n}","typeGuard":"func isResolvableTarget(t string) bool {\n    return strings.HasPrefix(t, \"CN=\") || strings.HasPrefix(t, \"cn=\") ||\n        strings.HasPrefix(t, \"S-1-\") || !strings.Contains(t, \"@\")\n}","tryCatchPattern":"secret, err := c.DCSync(target)\nif err != nil && strings.Contains(err.Error(), \"could not resolve\") {\n    // account name wrong or UPN form used: retry with sAMAccountName or SID\n    secret, err = c.DCSync(samFromSid(sid))\n}","preventionTips":["Pass sAMAccountName or objectSid, never UPN (user@domain)","Prefetch SIDs or DNs during recon and feed those into DCSync","Treat crack-names failure as a signal to re-enumerate the account, not to retry blindly"],"tags":["dcsync","active-directory","validation","input"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}