projectdiscovery/nuclei · error

lsa init: %w

Error message

lsa init: %w

What it means

gplsa.NewLsaClient(rpc) failed while constructing the LSARPC client over the opened lsarpc pipe in LsaLookupSids. Initialization beyond the bind — setting up the LSA context (session key / signing) — failed, typically because the negotiated session lacks an authenticated context (null session) or the server refuses LSA setup for the caller.

Source

Thrown at pkg/js/libs/dcerpc/dcerpc.go:482

// @example
// ```javascript
// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');
// const r = c.LsaLookupSids(['S-1-5-21-...-500']);
// log(to_json(r));
// ```
func (c *Client) LsaLookupSids(sids []string) ([]LookupResult, error) {
	c.nj.Require(len(sids) > 0, "at least one SID must be provided")
	rpc, err := c.rpcOverNamedPipe("lsarpc", gplsa.UUID, gplsa.MajorVersion, gplsa.MinorVersion)
	if err != nil {
		return nil, err
	}
	defer func() {
		_ = rpc.Transport.Close()
	}()

	lsa, err := gplsa.NewLsaClient(rpc)
	if err != nil {
		return nil, fmt.Errorf("lsa init: %w", err)
	}
	if err := lsa.OpenPolicy2(); err != nil {
		return nil, fmt.Errorf("lsa OpenPolicy2: %w", err)
	}
	defer lsa.Close()
	return lsa.LookupSids(sids)
}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Use authenticated domain credentials with the constructor or SetHash().
2. Ensure SMB3 with signing is available on the path.
3. Retry with admin credentials if hardening restricts LSA to privileged callers.
4. Verify lsarpc is the real endpoint with RpcDump.

Example fix

// before
const c = new dcerpc.Client('dc01', 'ACME', 'guest', '');
c.LsaLookupSids(['S-1-5-21-...-500']); // lsa init: ...

// after
const c = new dcerpc.Client('dc01', 'ACME', 'svc-scan', 'S3cure!pass');
c.LsaLookupSids(['S-1-5-21-...-500']);

try {
  const r = c.LsaLookupSids(sids);
} catch (e) {
  const msg = String(e);
  if (msg.includes('lsa init')) {
    // LSA context setup failed: auth context (null session) or hardening
    log('LSA init failed: ' + msg);
  } else throw e;
}

When it happens

Trigger: LsaLookupSids() after pipe+bind when the session cannot support the LSA context: null/guest credentials, signing unavailable (downgraded SMB), or hardened DCs refusing LSA over low-privilege sessions.

Common situations: Anonymous SID lookups post-hardening; environments where SMB signing is not negotiated; EDR hooking lsarpc.

Related errors

• lsa OpenPolicy2: %w
• smb connect: %w
• open pipe %q: %w
• dcerpc bind: %w
• samr connect: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/5bfeac88fc8bd3d0. Report an issue: GitHub.