{"record":{"id":"a4d71c2983ef8cdd","repo":"projectdiscovery/nuclei","slug":"open-atsvc-pipe-w","errorCode":null,"errorMessage":"open atsvc pipe: %w","messagePattern":"open atsvc pipe: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/dcerpc.go","lineNumber":388,"sourceCode":"//\n// @example\n// ```javascript\n// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');\n// const r = c.AtExec('whoami /all', 'ADMIN$');\n// log(r.output);\n// ```\nfunc (c *Client) AtExec(command, share string) (*AtExecResult, error) {\n\tc.nj.Require(command != \"\", \"command cannot be empty\")\n\tif !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {\n\t\treturn nil, protocolstate.ErrHostDenied.Msgf(c.Host)\n\t}\n\tif err := c.connect(); err != nil {\n\t\treturn nil, err\n\t}\n\n\tpf, err := c.smb.OpenPipe(\"atsvc\")\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"open atsvc pipe: %w\", err)\n\t}\n\tdefer func() { _ = pf.Close() }()\n\n\trpc := gprpc.NewClient(pf)\n\tif err := rpc.BindAuth(gptsch.UUID, gptsch.MajorVersion, gptsch.MinorVersion, c.creds); err != nil {\n\t\treturn nil, fmt.Errorf(\"tsch bind: %w\", err)\n\t}\n\tts := gptsch.NewTaskScheduler(rpc)\n\n\tres, err := gpatexec.Exec(ts, c.smb, command, gpatexec.Options{\n\t\tShare:     share,\n\t\tTimeout:   15 * time.Second,\n\t\tSessionID: -1,\n\t})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn &AtExecResult{TaskName: res.TaskName, Output: res.Output}, nil","sourceCodeStart":370,"sourceCodeEnd":406,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/dcerpc.go#L370-L406","documentation":"AtExec opens the atsvc named pipe and the open failed. The Task Scheduler RPC endpoint is absent (Schedule service stopped or disabled) or the session is denied the pipe open. Same failure class as error 200/209, specific to the scheduled-task execution path.","triggerScenarios":"Client.AtExec(command, share) where the Task Scheduler service is disabled, the pipe ACL denies the account, or EDR blocks atsvc opens.","commonSituations":"Hardened builds with the Task Scheduler service disabled; non-admin credentials; EDR watching at-* pipes.","solutions":["Ensure the Task Scheduler service is running on the target.","Use administrator credentials for scheduled-task execution.","Verify the pipe exists (RpcDump / pipe listing) before choosing AtExec.","Fall back to SmbExec over svcctl if atsvc is unavailable."],"exampleFix":"// before\nc.AtExec('whoami', 'C$'); // open atsvc pipe: OBJECT_NAME_NOT_FOUND\n\n// after\ntry {\n  c.AtExec('whoami', 'C$');\n} catch (e) {\n  if (String(e).includes('open atsvc pipe')) {\n    c.SmbExec('whoami', 'ADMIN$'); // svcctl path instead\n  } else throw e;\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const r = c.AtExec(cmd, 'C$');\n} catch (e) {\n  const msg = String(e);\n  if (msg.includes('open atsvc pipe')) {\n    c.SmbExec(cmd, 'ADMIN$'); // Task Scheduler surface missing → SCM path\n  } else throw e;\n}","preventionTips":["Check the Task Scheduler service state before choosing the atsvc path.","Use admin credentials for scheduled-task execution.","Confirm pipe availability with RpcDump when 135 is reachable."],"tags":["atexec","task-scheduler","named-pipes","smb","windows"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}