projectdiscovery/nuclei · error

svcctl bind: %w

Error message

svcctl bind: %w

What it means

In SmbExec, after svcctl opened, the (unauthenticated) rpc.Bind to the SVCCTL interface failed. Rare: the pipe accepted the open but the DCE/RPC bind exchange failed — usually a security product intercepting the pipe, a non-Microsoft SMB stack answering opens without a real RPC endpoint behind them, or a transient reset mid-bind.

Source

Thrown at pkg/js/libs/dcerpc/dcerpc.go:331

	c.nj.Require(command != "", "command cannot be empty")
	if !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {
		return nil, protocolstate.ErrHostDenied.Msgf(c.Host)
	}
	if err := c.connect(); err != nil {
		return nil, err
	}

	pf, err := c.smb.OpenPipe("svcctl")
	if err != nil {
		return nil, fmt.Errorf("open svcctl pipe: %w", err)
	}
	defer func() {
		_ = pf.Close()
	}()

	rpc := gprpc.NewClient(pf)
	if err := rpc.Bind(gpsvcctl.UUID, gpsvcctl.MajorVersion, gpsvcctl.MinorVersion); err != nil {
		return nil, fmt.Errorf("svcctl bind: %w", err)
	}
	sc, err := gpsvcctl.NewServiceController(rpc)
	if err != nil {
		return nil, fmt.Errorf("svcctl open scm: %w", err)
	}
	defer sc.Close()

	res, err := gpsmbexec.Exec(sc, c.smb, command, gpsmbexec.Options{
		Share:   share,
		Mode:    gpsmbexec.ModeShare,
		Timeout: 10 * time.Second,
	})
	if err != nil {
		return nil, err
	}
	return &SmbExecResult{ServiceName: res.ServiceName, Output: res.Output}, nil
}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Check whether classic psexec / 'sc \\host query' works to isolate whether SCM over the pipe functions at all.
2. Retry once for transient resets.
3. Try AtExec (atsvc + Task Scheduler) as an alternate execution path.
4. Inspect EDR posture on the target.

Example fix

// before
c.SmbExec('whoami', 'ADMIN$'); // svcctl bind: ...

// after (alternate exec path on svcctl bind failure)
try {
  c.SmbExec('whoami', 'ADMIN$');
} catch (e) {
  if (String(e).includes('svcctl bind')) {
    c.AtExec('whoami', 'C$'); // tsch over atsvc instead
  } else throw e;
}

try {
  const r = c.SmbExec(cmd, 'ADMIN$');
} catch (e) {
  const msg = String(e);
  if (msg.includes('svcctl bind')) {
    // pipe open but RPC bind failed: middleware/EDR or broken stack
    c.AtExec(cmd, 'C$'); // alternate path
  } else throw e;
}

When it happens

Trigger: SmbExec on hosts fronted by pipe-inspecting EDR or SMB proxies; malformed stacks that complete SMB opens but not RPC binds; connection reset between open and bind.

Common situations: EDR/IPS tampering with DCE/RPC-over-SMB; Samba servers with mismatched pipe aliases.

Related errors

• smb connect: %w
• open pipe %q: %w
• dcerpc bind: %w
• epmapper bind: %w
• open svcctl pipe: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/1b9624c421045cd9. Report an issue: GitHub.