{"record":{"id":"eb2cf26c4fdfabc7","repo":"projectdiscovery/nuclei","slug":"epmapper-bind-w","errorCode":null,"errorMessage":"epmapper bind: %w","messagePattern":"epmapper bind: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/dcerpc.go","lineNumber":222,"sourceCode":"// for (const e of eps) { log(e.UUID + ' ' + e.Annotation); }\n// ```\nfunc (c *Client) RpcDump(ctx context.Context) ([]Endpoint, error) {\n\tif !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {\n\t\treturn nil, protocolstate.ErrHostDenied.Msgf(c.Host)\n\t}\n\tdialer := protocolstate.GetDialersWithId(c.nj.ExecutionId())\n\tif dialer == nil {\n\t\treturn nil, fmt.Errorf(\"dialers not initialized for execution %s\", c.nj.ExecutionId())\n\t}\n\tconn, err := dialer.Fastdialer.Dial(ctx, \"tcp\", net.JoinHostPort(c.Host, strconv.Itoa(135)))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"dial epmapper: %w\", err)\n\t}\n\tdefer func() { _ = conn.Close() }()\n\n\trpc := gprpc.NewClientTCP(gprpc.NewTCPTransport(conn))\n\tif err := rpc.Bind(gpepm.UUID, gpepm.MajorVersion, gpepm.MinorVersion); err != nil {\n\t\treturn nil, fmt.Errorf(\"epmapper bind: %w\", err)\n\t}\n\tepm := gpepm.NewEpmClient(rpc)\n\treturn epm.Lookup()\n}\n\n// SamrEnumerateUsers connects to SAMR and returns every domain user record\n// (impacket: samrdump.py).\n//\n// @example\n// ```javascript\n// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');\n// const users = c.SamrEnumerateUsers();\n// for (const u of users) { log(u.Name + ' ' + u.RID); }\n// ```\nfunc (c *Client) SamrEnumerateUsers() ([]DomainUser, error) {\n\trpc, err := c.rpcOverNamedPipe(\"samr\", gpsamr.UUID, gpsamr.MajorVersion, gpsamr.MinorVersion)\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/dcerpc.go#L204-L240","documentation":"TCP to 135 succeeded but the DCE/RPC bind to the EPMAPPER interface (rpc.Bind with the epmapper UUID/version) failed. A protocol-level rejection rather than a connectivity failure: the endpoint-mapper service is broken, or a middlebox (IDS/IPS, RPC filter, TCP proxy) mangles the bind PDU, or (rarely) a version-negotiation mismatch.","triggerScenarios":"RpcDump() where something answers on 135 but never returns a valid bind ack: crashed RPC service after patching, transparent proxies/IPS on the path, or a honeypot accepting any TCP connection.","commonSituations":"IPS signatures tripping on DCE/RPC binds; partially broken hosts; deceptive endpoints answering all ports.","solutions":["Cross-check with impacket's rpcdump.py — if it also fails, the problem is host-side or path-side, not nuclei.","Retry once: some middleboxes drop the first PDU of a connection.","Inspect the path for IPS/proxies that intercept 135.","Fall back to named-pipe enumeration methods over 445 which avoid the endpoint mapper."],"exampleFix":"// before\nconst eps = c.RpcDump(); // epmapper bind: ...\n\n// after (single retry, then fall back)\nlet eps = null;\nfor (let i = 0; i < 2 && eps === null; i++) {\n  try { eps = c.RpcDump(); } catch (e) { log('epmapper bind attempt ' + i + ' failed: ' + e); }\n}\nif (eps === null) eps = []; // continue with pipe-based methods instead","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const eps = c.RpcDump();\n} catch (e) {\n  const msg = String(e);\n  if (msg.includes('epmapper bind')) {\n    // port 135 answers but RPC bind is rejected: middlebox or broken service\n    log('epmapper bind rejected: ' + msg);\n  } else throw e;\n}","preventionTips":["Cross-validate EPM behavior with an independent tool (rpcdump.py) when triaging.","Treat bind failure differently from dial failure in template logic — they have different causes.","Retain a named-pipe fallback path that avoids the endpoint mapper entirely."],"tags":["dcerpc","epmapper","bind","rpc","ips"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}