projectdiscovery/nuclei · error

drsuapi bind: %w

Error message

drsuapi bind: %w

What it means

After opening the lsass pipe, the code creates an RPC client and binds to the DRSUAPI interface (UUID + version) with explicit credentials via BindAuth. This error means the bind or its authentication layer was rejected: the DC refused the auth context (bad creds at RPC level, signing mismatch) or NACKed the DRSUAPI interface.

Source

Thrown at pkg/js/libs/secretsdump/secretsdump.go:128

	}

	smb := gpsmb.NewClient(c.target, c.creds)
	if err := smb.Connect(); err != nil {
		return nil, fmt.Errorf("smb connect: %w", err)
	}
	defer smb.Close()

	pipe, err := smb.OpenPipe("\\PIPE\\lsass")
	if err != nil {
		// Fall back to drsuapi-named pipe; both are accepted by the DC.
		pipe, err = smb.OpenPipe("lsass")
		if err != nil {
			return nil, fmt.Errorf("open lsass pipe: %w", err)
		}
	}
	rpc := gprpc.NewClient(pipe)
	if err := rpc.BindAuth(gpdrs.UUID, gpdrs.MajorVersion, gpdrs.MinorVersion, c.creds); err != nil {
		return nil, fmt.Errorf("drsuapi bind: %w", err)
	}
	defer func() {
		_ = rpc.Transport.Close()
	}()

	bind, err := gpdrs.DsBind(rpc)
	if err != nil {
		return nil, fmt.Errorf("ds bind: %w", err)
	}

	dcInfo, err := gpdrs.DsDomainControllerInfo(rpc, bind.Handle, c.Domain)
	if err != nil {
		return nil, fmt.Errorf("ds dc info: %w", err)
	}

	domainDN, err := gpdrs.GetDomainDN(rpc, bind.Handle, c.Domain)
	if err != nil {
		return nil, fmt.Errorf("ds domain dn: %w", err)

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Re-verify the domain\\user form and password used to construct the Client
2. If using a hash, call SetHash(':<nthash>') with the LM:NTHash colon format
3. Confirm the target hosts DRSUAPI (it must be a DC)
4. Check whether DC policy requires Kerberos-only for DRSUAPI binds

Example fix

// before
const c = new sd.Client('dc01', 'acme.local', 'admin', 'P@ss');
c.SetHash('31d6cfe0d16ae931b73c59d7e0c089c0'); // missing leading colon -> drsuapi bind fails

// after
c.SetHash(':31d6cfe0d16ae931b73c59d7e0c089c0');

if err := c.DCSyncRaw(); err != nil { // conceptual
    if strings.Contains(err.Error(), "drsuapi bind:") {
        // auth at RPC layer: re-check creds/hash format before retrying
        c.SetHash(":" + nthash)
    }
}

When it happens

Trigger: rpc.BindAuth(gpdrs.UUID, ...) fails because credentials are invalid, the connection requires SMB signing that was not negotiated, or the endpoint does not host DRSUAPI (non-DC again, or drsuapi disabled).

Common situations: Password correct for SMB session but wrong domain prefix in creds; DC enforces RPC privacy/signing the client cannot satisfy; pass-the-hash given in a malformed format.

Related errors

• smb connect: %w
• dcerpc bind: %w
• epmapper bind: %w
• tsch bind: %w
• lsa init: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/2642282a9940bc86. Report an issue: GitHub.