projectdiscovery/nuclei · error

dial epmapper: %w

Error message

dial epmapper: %w

What it means

RpcDump dials tcp/<host>:135 via the fastdialer and the dial failed: connection refused, i/o timeout, no route, or DNS resolution failure. A pure L3/L4 reachability problem for the RPC endpoint-mapper port, raised after the host allow/deny policy check already passed.

Source

Thrown at pkg/js/libs/dcerpc/dcerpc.go:216

//
// @example
// ```javascript
// const dcerpc = require('nuclei/dcerpc');
// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');
// const eps = c.RpcDump();
// for (const e of eps) { log(e.UUID + ' ' + e.Annotation); }
// ```
func (c *Client) RpcDump(ctx context.Context) ([]Endpoint, error) {
	if !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {
		return nil, protocolstate.ErrHostDenied.Msgf(c.Host)
	}
	dialer := protocolstate.GetDialersWithId(c.nj.ExecutionId())
	if dialer == nil {
		return nil, fmt.Errorf("dialers not initialized for execution %s", c.nj.ExecutionId())
	}
	conn, err := dialer.Fastdialer.Dial(ctx, "tcp", net.JoinHostPort(c.Host, strconv.Itoa(135)))
	if err != nil {
		return nil, fmt.Errorf("dial epmapper: %w", err)
	}
	defer func() { _ = conn.Close() }()

	rpc := gprpc.NewClientTCP(gprpc.NewTCPTransport(conn))
	if err := rpc.Bind(gpepm.UUID, gpepm.MajorVersion, gpepm.MinorVersion); err != nil {
		return nil, fmt.Errorf("epmapper bind: %w", err)
	}
	epm := gpepm.NewEpmClient(rpc)
	return epm.Lookup()
}

// SamrEnumerateUsers connects to SAMR and returns every domain user record
// (impacket: samrdump.py).
//
// @example
// ```javascript
// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');
// const users = c.SamrEnumerateUsers();

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Confirm 135/tcp is open on the target (nuclei port check or nmap -p135) and fix firewalling on the path.
2. Verify the target is actually Windows and the RPC service is running.
3. If only 445 is permitted, skip RpcDump and use the named-pipe methods (SamrEnumerateUsers, EnumServices).
4. Check name resolution of c.Host (use an IP to bypass DNS issues).

Example fix

// before
const eps = c.RpcDump(); // dial epmapper: dial tcp ...:135: i/o timeout

// after
let eps;
try {
  eps = c.RpcDump();
} catch (e) {
  // 135 filtered: fall back to named-pipe enumeration over 445
  log('epmapper unreachable (' + e + '), falling back to SAMR over 445');
  eps = [];
}

let endpoints = null;
for (let attempt = 0; attempt < 2 && endpoints === null; attempt++) {
  try {
    endpoints = c.RpcDump();
  } catch (e) {
    const msg = String(e);
    if (!msg.includes('dial epmapper')) throw e; // only retry dial failures
    log('epmapper dial failed, attempt ' + attempt + ': ' + msg);
  }
}
if (endpoints === null) { /* 135 unreachable: fall back to pipe-based methods over 445 */ }

When it happens

Trigger: Client.RpcDump() against a down/unreachable host, a host firewalled on 135 (Windows client SKUs block inbound RPC by default), a non-Windows device answering nothing on 135, or a filtered VPN path.

Common situations: Corporate or host firewalls filtering 135; scanning workstations with File and Printer Sharing disabled; typo'd hostname that never resolves; IPS dropping RPC traffic.

Related errors

• epmapper bind: %w
• failed to send encryption packet: %w
• headless mode (-headless) is required if -ho, -sb, -sc or -l
• both follow host redirects and follow redirects specified
• both follow redirects and disable redirects specified

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/bf093e3582b22650. Report an issue: GitHub.