{"record":{"id":"a911582d81430d90","repo":"projectdiscovery/nuclei","slug":"open-pipe-q-w","errorCode":null,"errorMessage":"open pipe %q: %w","messagePattern":"open pipe %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/dcerpc.go","lineNumber":186,"sourceCode":"}\n\n// Close releases the underlying SMB session.\nfunc (c *Client) Close() {\n\tif c.smb != nil {\n\t\tc.smb.Close()\n\t}\n\tc.started = false\n}\n\n// rpcOverNamedPipe binds the supplied interface UUID over a named pipe and\n// returns an authenticated *dcerpc.Client.\nfunc (c *Client) rpcOverNamedPipe(pipe string, uuid [16]byte, major, minor uint16) (*gprpc.Client, error) {\n\tif err := c.connect(); err != nil {\n\t\treturn nil, err\n\t}\n\tpf, err := c.smb.OpenPipe(pipe)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"open pipe %q: %w\", pipe, err)\n\t}\n\trpc := gprpc.NewClient(pf)\n\tif err := rpc.BindAuth(uuid, major, minor, c.creds); err != nil {\n\t\t_ = pf.Close()\n\t\treturn nil, fmt.Errorf(\"dcerpc bind: %w\", err)\n\t}\n\treturn rpc, nil\n}\n\n// RpcDump enumerates every RPC endpoint registered with the EPMAPPER over\n// ncacn_ip_tcp/135 (impacket: rpcdump.py).\n//\n// @example\n// ```javascript\n// const dcerpc = require('nuclei/dcerpc');\n// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');\n// const eps = c.RpcDump();\n// for (const e of eps) { log(e.UUID + ' ' + e.Annotation); }","sourceCodeStart":168,"sourceCodeEnd":204,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/dcerpc.go#L168-L204","documentation":"Thrown by the shared rpcOverNamedPipe helper in nuclei's dcerpc JS library after the SMB session on 445 is already established: c.smb.OpenPipe(pipe) failed to open the requested Windows named pipe (samr, lsarpc, svcctl, ctx_winstation), with the pipe name embedded in the message. It means the host speaks SMB but does not expose that pipe — the backing Windows service is stopped/absent, or the session lacks rights to open it (STATUS_OBJECT_NAME_NOT_FOUND / STATUS_ACCESS_DENIED).","triggerScenarios":"Any method routed through rpcOverNamedPipe: SamrEnumerateUsers(), SamrAddComputer() (pipe 'samr'), LsaLookupSids() ('lsarpc'), EnumServices()/EnumSessions() ('svcctl'/'srvsvc'), EnumProcesses() ('ctx_winstation'). Fires when OpenPipe errors, e.g. Task Scheduler stopped so the pipe is missing, or 'samr' removed by SAM-RPC hardening on a patched DC.","commonSituations":"Non-admin or null-session credentials denied the pipe open; hardening that removes samr/lsarpc from domain controllers; EDR products that block named-pipe opens; Samba appliances implementing only a subset of pipes.","solutions":["Enumerate what the target actually exposes: call c.RpcDump() (EPMAPPER on tcp/135) or list pipes with the nuclei smb library and confirm the pipe exists.","Run/enable the backing Windows service on the target (Server service for svcctl, Task Scheduler for atsvc) or pick a host that exposes the pipe.","Re-run with credentials that have rights to the pipe: valid domain user/password in new dcerpc.Client(...), or SetHash()/SetKerberos() for pass-the-hash/Kerberos.","If the pipe is deliberately removed by hardening, treat the endpoint as unavailable and pivot to a different interface (e.g. lsarpc instead of samr)."],"exampleFix":"// before\nconst c = new dcerpc.Client('dc01', 'ACME', 'user', 'pass');\nconst users = c.SamrEnumerateUsers(); // throws: open pipe \"samr\": ...\n\n// after\nconst c = new dcerpc.Client('dc01', 'ACME', 'user', 'pass');\ntry {\n  const users = c.SamrEnumerateUsers();\n} catch (e) {\n  // pipe-level failure: see what the host actually serves\n  const eps = c.RpcDump().filter(ep => String(ep.Protocol||'').includes('ncacn_np'));\n  log('samr pipe unavailable; named-pipe endpoints: ' + to_json(eps));\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const users = c.SamrEnumerateUsers();\n} catch (e) {\n  const msg = String((e && e.message) || e);\n  if (msg.includes('open pipe')) {\n    // pipe-level: host does not serve this RPC endpoint or denied the open\n    log('pipe unavailable: ' + msg);\n  } else {\n    throw e; // different failure class\n  }\n}","preventionTips":["Pre-verify the pipe exists via c.RpcDump() and match method names to served endpoints before calling.","Prefer authenticated (non-null) credentials so pipe ACLs do not deny the open.","Close the client (c.Close()) between retries so a stale SMB session does not confuse later calls."],"tags":["dcerpc","smb","named-pipes","windows","network"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}