{"record":{"id":"a53ca9c1479802ee","repo":"projectdiscovery/nuclei","slug":"open-svcctl-pipe-w","errorCode":null,"errorMessage":"open svcctl pipe: %w","messagePattern":"open svcctl pipe: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/dcerpc.go","lineNumber":323,"sourceCode":"// @example\n// ```javascript\n// const dcerpc = require('nuclei/dcerpc');\n// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');\n// const r = c.SmbExec('whoami /all', 'C$');\n// log(r.output);\n// ```\nfunc (c *Client) SmbExec(command, share string) (*SmbExecResult, error) {\n\tc.nj.Require(command != \"\", \"command cannot be empty\")\n\tif !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {\n\t\treturn nil, protocolstate.ErrHostDenied.Msgf(c.Host)\n\t}\n\tif err := c.connect(); err != nil {\n\t\treturn nil, err\n\t}\n\n\tpf, err := c.smb.OpenPipe(\"svcctl\")\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"open svcctl pipe: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = pf.Close()\n\t}()\n\n\trpc := gprpc.NewClient(pf)\n\tif err := rpc.Bind(gpsvcctl.UUID, gpsvcctl.MajorVersion, gpsvcctl.MinorVersion); err != nil {\n\t\treturn nil, fmt.Errorf(\"svcctl bind: %w\", err)\n\t}\n\tsc, err := gpsvcctl.NewServiceController(rpc)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"svcctl open scm: %w\", err)\n\t}\n\tdefer sc.Close()\n\n\tres, err := gpsmbexec.Exec(sc, c.smb, command, gpsmbexec.Options{\n\t\tShare:   share,\n\t\tMode:    gpsmbexec.ModeShare,","sourceCodeStart":305,"sourceCodeEnd":341,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/dcerpc.go#L305-L341","documentation":"SmbExec opens the svcctl named pipe directly (c.smb.OpenPipe(\"svcctl\")) after the SMB session is established, and the open failed. Same meaning as error 200 but for command execution: the Remote Service Management surface is missing or denied. Frequently paired with Windows Firewall blocking Remote Service Management or EDR flagging PsExec-style pipe opens.","triggerScenarios":"Client.SmbExec(command, share) on hosts where svcctl is absent/blocked, or with non-admin credentials; EDR intercepting svcctl opens as a lateral-movement indicator.","commonSituations":"Non-admin credentials (most common); client SKUs with inbound Remote Service Management disabled by firewall defaults; EDR blocking the pipe used by psexec-style tools.","solutions":["Use administrator credentials for the target.","Allow 445 and the Remote Service Management firewall groups on the target.","Verify the Server service is running on the target.","If EDR blocks svcctl, this technique is denied regardless of credentials — switch to AtExec (atsvc/tsch) or WMI."],"exampleFix":"// before\nconst c = new dcerpc.Client('wk01', 'ACME', 'bob', 'bob-pass');\nc.SmbExec('whoami', 'ADMIN$'); // open svcctl pipe: ACCESS_DENIED\n\n// after\nconst c = new dcerpc.Client('wk01', 'ACME', 'adm', 'adm-pass'); // local/domain admin\ntry {\n  c.SmbExec('whoami', 'ADMIN$');\n} catch (e) {\n  log('svcctl blocked, trying atsvc: ' + e);\n  c.AtExec('whoami', 'C$');\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const r = c.SmbExec('whoami', 'ADMIN$');\n} catch (e) {\n  const msg = String(e);\n  if (msg.includes('open svcctl pipe')) {\n    log('svcctl unavailable/denied: ' + msg); // try AtExec or WMI instead\n  } else throw e;\n}","preventionTips":["Use admin credentials for command-execution techniques.","Confirm Remote Service Management firewall rules are enabled on targets.","Keep an alternate execution path (atsvc/WMI) in the template."],"tags":["smbexec","psexec","svcctl","smb","lateral-movement"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}