projectdiscovery/nuclei · error

dcerpc bind: %w

Error message

dcerpc bind: %w

What it means

rpc.BindAuth(uuid, major, minor, c.creds) failed on the freshly opened named pipe in rpcOverNamedPipe. The DCE/RPC bind carrying the NTLM/Kerberos auth context was rejected: invalid credentials at bind time, an auth package refused (NTLM banned on the DC), or the interface UUID/version is not served on that pipe. Distinct from 'open pipe': the pipe exists, the bind/altered-bind exchange failed.

Source

Thrown at pkg/js/libs/dcerpc/dcerpc.go:191

		c.smb.Close()
	}
	c.started = false
}

// rpcOverNamedPipe binds the supplied interface UUID over a named pipe and
// returns an authenticated *dcerpc.Client.
func (c *Client) rpcOverNamedPipe(pipe string, uuid [16]byte, major, minor uint16) (*gprpc.Client, error) {
	if err := c.connect(); err != nil {
		return nil, err
	}
	pf, err := c.smb.OpenPipe(pipe)
	if err != nil {
		return nil, fmt.Errorf("open pipe %q: %w", pipe, err)
	}
	rpc := gprpc.NewClient(pf)
	if err := rpc.BindAuth(uuid, major, minor, c.creds); err != nil {
		_ = pf.Close()
		return nil, fmt.Errorf("dcerpc bind: %w", err)
	}
	return rpc, nil
}

// RpcDump enumerates every RPC endpoint registered with the EPMAPPER over
// ncacn_ip_tcp/135 (impacket: rpcdump.py).
//
// @example
// ```javascript
// const dcerpc = require('nuclei/dcerpc');
// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');
// const eps = c.RpcDump();
// for (const e of eps) { log(e.UUID + ' ' + e.Annotation); }
// ```
func (c *Client) RpcDump(ctx context.Context) ([]Endpoint, error) {
	if !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {
		return nil, protocolstate.ErrHostDenied.Msgf(c.Host)
	}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Verify the credentials work at the SMB layer first (e.g. open a nuclei smb session with the same values) to separate auth failure from bind failure.
2. Eliminate password typos by testing a known-good NT hash with SetHash('aad3...:nt-hash').
3. Check the domain argument and, for Kerberos, KDC reachability and host clock sync.
4. Confirm the interface is registered on that pipe with RpcDump().

Example fix

// before
const c = new dcerpc.Client('dc01', 'ACME', 'admin', 'typoed-password');
c.SamrEnumerateUsers(); // dcerpc bind: ... STATUS_LOGON_FAILURE

// after
const c = new dcerpc.Client('dc01', 'ACME', 'admin', '');
c.SetHash('aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'); // pass-the-hash with a verified hash
c.SamrEnumerateUsers();

try {
  const users = c.SamrEnumerateUsers();
} catch (e) {
  const msg = String((e && e.message) || e);
  if (msg.includes('dcerpc bind')) {
    // bind/auth rejected: re-check credentials, domain, or interface presence
    log('bind rejected: ' + msg);
  } else throw e;
}

When it happens

Trigger: SamrEnumerateUsers(), SamrAddComputer(), LsaLookupSids(), EnumServices(), EnumSessions(), EnumProcesses() after OpenPipe succeeded — typically a wrong password (bind-time STATUS_LOGON_FAILURE), a wrong domain string, or SetKerberos() with clock skew or an unreachable KDC breaking the AP-REQ.

Common situations: Wrong password/domain in the Client constructor; DCs enforcing Kerberos-only with NTLM disabled; expired or locked accounts; time skew beyond 5 minutes when using Kerberos.

Related errors

• smb connect: %w
• tsch bind: %w
• open pipe %q: %w
• svcctl bind: %w
• lsa init: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/c2e49b76eb99139a. Report an issue: GitHub.