projectdiscovery/nuclei · error

open svcctl pipe: %w

Error message

open svcctl pipe: %w

What it means

SmbExec opens the svcctl named pipe directly (c.smb.OpenPipe("svcctl")) after the SMB session is established, and the open failed. Same meaning as error 200 but for command execution: the Remote Service Management surface is missing or denied. Frequently paired with Windows Firewall blocking Remote Service Management or EDR flagging PsExec-style pipe opens.

Source

Thrown at pkg/js/libs/dcerpc/dcerpc.go:323

// @example
// ```javascript
// const dcerpc = require('nuclei/dcerpc');
// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');
// const r = c.SmbExec('whoami /all', 'C$');
// log(r.output);
// ```
func (c *Client) SmbExec(command, share string) (*SmbExecResult, error) {
	c.nj.Require(command != "", "command cannot be empty")
	if !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {
		return nil, protocolstate.ErrHostDenied.Msgf(c.Host)
	}
	if err := c.connect(); err != nil {
		return nil, err
	}

	pf, err := c.smb.OpenPipe("svcctl")
	if err != nil {
		return nil, fmt.Errorf("open svcctl pipe: %w", err)
	}
	defer func() {
		_ = pf.Close()
	}()

	rpc := gprpc.NewClient(pf)
	if err := rpc.Bind(gpsvcctl.UUID, gpsvcctl.MajorVersion, gpsvcctl.MinorVersion); err != nil {
		return nil, fmt.Errorf("svcctl bind: %w", err)
	}
	sc, err := gpsvcctl.NewServiceController(rpc)
	if err != nil {
		return nil, fmt.Errorf("svcctl open scm: %w", err)
	}
	defer sc.Close()

	res, err := gpsmbexec.Exec(sc, c.smb, command, gpsmbexec.Options{
		Share:   share,
		Mode:    gpsmbexec.ModeShare,

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Use administrator credentials for the target.
2. Allow 445 and the Remote Service Management firewall groups on the target.
3. Verify the Server service is running on the target.
4. If EDR blocks svcctl, this technique is denied regardless of credentials — switch to AtExec (atsvc/tsch) or WMI.

Example fix

// before
const c = new dcerpc.Client('wk01', 'ACME', 'bob', 'bob-pass');
c.SmbExec('whoami', 'ADMIN$'); // open svcctl pipe: ACCESS_DENIED

// after
const c = new dcerpc.Client('wk01', 'ACME', 'adm', 'adm-pass'); // local/domain admin
try {
  c.SmbExec('whoami', 'ADMIN$');
} catch (e) {
  log('svcctl blocked, trying atsvc: ' + e);
  c.AtExec('whoami', 'C$');
}

try {
  const r = c.SmbExec('whoami', 'ADMIN$');
} catch (e) {
  const msg = String(e);
  if (msg.includes('open svcctl pipe')) {
    log('svcctl unavailable/denied: ' + msg); // try AtExec or WMI instead
  } else throw e;
}

When it happens

Trigger: Client.SmbExec(command, share) on hosts where svcctl is absent/blocked, or with non-admin credentials; EDR intercepting svcctl opens as a lateral-movement indicator.

Common situations: Non-admin credentials (most common); client SKUs with inbound Remote Service Management disabled by firewall defaults; EDR blocking the pipe used by psexec-style tools.

Related errors

• svcctl bind: %w
• no templates provided for scan
• no input provider found
• no templates provided for scan
• template threads must be at least 1

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/a53ca9c1479802ee. Report an issue: GitHub.