{"record":{"id":"c2e49b76eb99139a","repo":"projectdiscovery/nuclei","slug":"dcerpc-bind-w","errorCode":null,"errorMessage":"dcerpc bind: %w","messagePattern":"dcerpc bind: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/dcerpc.go","lineNumber":191,"sourceCode":"\t\tc.smb.Close()\n\t}\n\tc.started = false\n}\n\n// rpcOverNamedPipe binds the supplied interface UUID over a named pipe and\n// returns an authenticated *dcerpc.Client.\nfunc (c *Client) rpcOverNamedPipe(pipe string, uuid [16]byte, major, minor uint16) (*gprpc.Client, error) {\n\tif err := c.connect(); err != nil {\n\t\treturn nil, err\n\t}\n\tpf, err := c.smb.OpenPipe(pipe)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"open pipe %q: %w\", pipe, err)\n\t}\n\trpc := gprpc.NewClient(pf)\n\tif err := rpc.BindAuth(uuid, major, minor, c.creds); err != nil {\n\t\t_ = pf.Close()\n\t\treturn nil, fmt.Errorf(\"dcerpc bind: %w\", err)\n\t}\n\treturn rpc, nil\n}\n\n// RpcDump enumerates every RPC endpoint registered with the EPMAPPER over\n// ncacn_ip_tcp/135 (impacket: rpcdump.py).\n//\n// @example\n// ```javascript\n// const dcerpc = require('nuclei/dcerpc');\n// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');\n// const eps = c.RpcDump();\n// for (const e of eps) { log(e.UUID + ' ' + e.Annotation); }\n// ```\nfunc (c *Client) RpcDump(ctx context.Context) ([]Endpoint, error) {\n\tif !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {\n\t\treturn nil, protocolstate.ErrHostDenied.Msgf(c.Host)\n\t}","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/dcerpc.go#L173-L209","documentation":"rpc.BindAuth(uuid, major, minor, c.creds) failed on the freshly opened named pipe in rpcOverNamedPipe. The DCE/RPC bind carrying the NTLM/Kerberos auth context was rejected: invalid credentials at bind time, an auth package refused (NTLM banned on the DC), or the interface UUID/version is not served on that pipe. Distinct from 'open pipe': the pipe exists, the bind/altered-bind exchange failed.","triggerScenarios":"SamrEnumerateUsers(), SamrAddComputer(), LsaLookupSids(), EnumServices(), EnumSessions(), EnumProcesses() after OpenPipe succeeded — typically a wrong password (bind-time STATUS_LOGON_FAILURE), a wrong domain string, or SetKerberos() with clock skew or an unreachable KDC breaking the AP-REQ.","commonSituations":"Wrong password/domain in the Client constructor; DCs enforcing Kerberos-only with NTLM disabled; expired or locked accounts; time skew beyond 5 minutes when using Kerberos.","solutions":["Verify the credentials work at the SMB layer first (e.g. open a nuclei smb session with the same values) to separate auth failure from bind failure.","Eliminate password typos by testing a known-good NT hash with SetHash('aad3...:nt-hash').","Check the domain argument and, for Kerberos, KDC reachability and host clock sync.","Confirm the interface is registered on that pipe with RpcDump()."],"exampleFix":"// before\nconst c = new dcerpc.Client('dc01', 'ACME', 'admin', 'typoed-password');\nc.SamrEnumerateUsers(); // dcerpc bind: ... STATUS_LOGON_FAILURE\n\n// after\nconst c = new dcerpc.Client('dc01', 'ACME', 'admin', '');\nc.SetHash('aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'); // pass-the-hash with a verified hash\nc.SamrEnumerateUsers();","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const users = c.SamrEnumerateUsers();\n} catch (e) {\n  const msg = String((e && e.message) || e);\n  if (msg.includes('dcerpc bind')) {\n    // bind/auth rejected: re-check credentials, domain, or interface presence\n    log('bind rejected: ' + msg);\n  } else throw e;\n}","preventionTips":["Validate credentials against the SMB layer (nuclei smb session) before issuing RPC calls.","Use SetHash() with a verified NT hash to remove password-format ambiguity.","Confirm clock sync and KDC reachability before SetKerberos()."],"tags":["dcerpc","authentication","kerberos","ntlm","smb"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}