{"record":{"id":"e52c1a6e86c7c497","repo":"projectdiscovery/nuclei","slug":"smb-connect-w-e52c1a","errorCode":null,"errorMessage":"smb connect: %w","messagePattern":"smb connect: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/secretsdump/secretsdump.go","lineNumber":114,"sourceCode":"// DCSync replicates secrets for a single principal (DN, sAMAccountName, or\n// SID) and returns its NT/LM hashes, hash history and account state.\n//\n// @example\n// ```javascript\n// const sd = require('nuclei/secretsdump');\n// const c = new sd.Client('dc01', 'acme.local', 'admin', 'P@ss');\n// const s = c.DCSync('Administrator');\n// log(s.nthash);\n// ```\nfunc (c *Client) DCSync(target string) (*Secret, error) {\n\tc.nj.Require(target != \"\", \"target cannot be empty\")\n\tif !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {\n\t\treturn nil, protocolstate.ErrHostDenied.Msgf(c.Host)\n\t}\n\n\tsmb := gpsmb.NewClient(c.target, c.creds)\n\tif err := smb.Connect(); err != nil {\n\t\treturn nil, fmt.Errorf(\"smb connect: %w\", err)\n\t}\n\tdefer smb.Close()\n\n\tpipe, err := smb.OpenPipe(\"\\\\PIPE\\\\lsass\")\n\tif err != nil {\n\t\t// Fall back to drsuapi-named pipe; both are accepted by the DC.\n\t\tpipe, err = smb.OpenPipe(\"lsass\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"open lsass pipe: %w\", err)\n\t\t}\n\t}\n\trpc := gprpc.NewClient(pipe)\n\tif err := rpc.BindAuth(gpdrs.UUID, gpdrs.MajorVersion, gpdrs.MinorVersion, c.creds); err != nil {\n\t\treturn nil, fmt.Errorf(\"drsuapi bind: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = rpc.Transport.Close()\n\t}()","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/secretsdump/secretsdump.go#L96-L132","documentation":"Thrown by secretsdump.Client.DCSync when the underlying goimpacket SMB client cannot establish a session to the domain controller on port 445. Connect() covers the TCP dial, SMB negotiation, and NTLM session setup, so an unreachable host, a filtered port, an SMB1-only server, or invalid credentials all surface here. The root cause is wrapped with %w and appears after the colon.","triggerScenarios":"Calling new sd.Client('dc01','acme.local','user','pass').DCSync('krbtgt') when dc01 does not resolve, port 445 is firewalled, the password is wrong (session setup fails inside Connect), or the target speaks SMB1 only.","commonSituations":"Typo in the DC hostname; egress firewall or VPN blocking 445; credentials captured for a different domain; lab DC that only allows Kerberos; account locked out or expired password.","solutions":["Verify reachability: nmap -p445 <dc> or Test-NetConnection <dc> -Port 445","Verify credentials independently with smbclient //<dc>/IPC$ or crackmapexec smb <dc> -u user -p pass","Confirm the DC hostname resolves (use the FQDN, e.g. dc01.acme.local)","Ensure the server supports SMB2/3 — goimpacket does not negotiate SMB1","For pass-the-hash, call c.SetHash(':<nthash>') instead of a plaintext password"],"exampleFix":"// before\nconst c = new sd.Client('dc01', 'acme.local', 'admin', 'WrongPass');\nconst s = c.DCSync('krbtgt'); // smb connect: ...session setup failed\n\n// after\nconst c = new sd.Client('dc01.acme.local', 'acme.local', 'admin', 'P@ss');\nconst s = c.DCSync('krbtgt');","handlingStrategy":"retry","validationCode":"// Verify 445 reachable and credentials valid before DCSync\nconn, err := net.DialTimeout(\"tcp\", net.JoinHostPort(dc, \"445\"), 5*time.Second)\nif err != nil { return fmt.Errorf(\"dc unreachable: %w\", err) }\n_ = conn.Close()","typeGuard":null,"tryCatchPattern":"secret, err := c.DCSync(target)\nif err != nil {\n    if strings.Contains(err.Error(), \"smb connect:\") {\n        // transport/session failure: check reachability, creds, SMB2 support\n        log.Printf(\"dc %s connect/auth failed: %v\", c.Host, err)\n    }\n    return err\n}","preventionTips":["Pre-verify port 445 reachability with a fast TCP dial before DCSync","Validate credentials with a cheap SMB session (smbclient/crackmapexec) first","Use the DC's FQDN, not short names, to avoid DNS ambiguity","Prefer SetHash(':nthash') for pass-the-hash instead of reconstructing passwords"],"tags":["network","smb","dcsync","active-directory","authentication"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}