projectdiscovery/nuclei · error

open lsass pipe: %w

Error message

open lsass pipe: %w

What it means

DCSync needs the DRSUAPI RPC endpoint reachable over an SMB named pipe. The code opens \\PIPE\\lsass and falls back to the short form 'lsass'; if both fail, no RPC transport exists. The usual causes are that the target is not a domain controller, the authenticated session is denied access to the pipe, or DC hardening removed the endpoint.

Source

Thrown at pkg/js/libs/secretsdump/secretsdump.go:123

// ```
func (c *Client) DCSync(target string) (*Secret, error) {
	c.nj.Require(target != "", "target cannot be empty")
	if !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {
		return nil, protocolstate.ErrHostDenied.Msgf(c.Host)
	}

	smb := gpsmb.NewClient(c.target, c.creds)
	if err := smb.Connect(); err != nil {
		return nil, fmt.Errorf("smb connect: %w", err)
	}
	defer smb.Close()

	pipe, err := smb.OpenPipe("\\PIPE\\lsass")
	if err != nil {
		// Fall back to drsuapi-named pipe; both are accepted by the DC.
		pipe, err = smb.OpenPipe("lsass")
		if err != nil {
			return nil, fmt.Errorf("open lsass pipe: %w", err)
		}
	}
	rpc := gprpc.NewClient(pipe)
	if err := rpc.BindAuth(gpdrs.UUID, gpdrs.MajorVersion, gpdrs.MinorVersion, c.creds); err != nil {
		return nil, fmt.Errorf("drsuapi bind: %w", err)
	}
	defer func() {
		_ = rpc.Transport.Close()
	}()

	bind, err := gpdrs.DsBind(rpc)
	if err != nil {
		return nil, fmt.Errorf("ds bind: %w", err)
	}

	dcInfo, err := gpdrs.DsDomainControllerInfo(rpc, bind.Handle, c.Domain)
	if err != nil {
		return nil, fmt.Errorf("ds dc info: %w", err)

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Confirm the target is actually a domain controller (ports 88/389/445, SPN LDAP/DC records, nltest /dsgetdc:domain)
2. Re-run with a Domain Admin or replication-privileged domain account
3. Use the DC's FQDN so the pipe resolves on the correct host
4. Check DC/EDR hardening that restricts named pipes (e.g. RestrictNamedPipeAccess style controls)

Example fix

// before
const c = new sd.Client('fileserver01', 'acme.local', 'admin', 'P@ss'); // not a DC
const s = c.DCSync('krbtgt'); // open lsass pipe: ...

// after
const c = new sd.Client('dc01.acme.local', 'acme.local', 'admin', 'P@ss');
const s = c.DCSync('krbtgt');

// Only attempt DCSync against confirmed DCs (LDAP/88/389 open, GC on 3268)
if !portOpen(dc, 88) || !portOpen(dc, 389) { return errors.New("target is not a DC") }

secret, err := c.DCSync(target)
if err != nil && strings.Contains(err.Error(), "open lsass pipe:") {
    // wrong host class or hardened DC: do not retry the same host
    log.Printf("%s exposes no DRSUAPI pipe; skipping", c.Host)
    return nil // treat as soft-skip in recon flows
}

When it happens

Trigger: Running DCSync against a member server or workstation instead of a DC; authenticating with a low-privilege or machine-local account; DC hardened (EDR/SMB hardening) so lsass pipe opens are rejected; connecting to a legacy Samba DC that does not expose the pipe.

Common situations: Target list contains non-DC hosts; local account used instead of a domain account; security tooling on the DC blocking named-pipe access; wrong port assumptions (IPC$ not available).

Related errors

• smb connect: %w
• drsuapi bind: %w
• ds bind: %w
• ds dc info: %w
• ds domain dn: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/3373757274debb7a. Report an issue: GitHub.