projectdiscovery/nuclei · error

svcctl open scm: %w

Error message

svcctl open scm: %w

What it means

gpsvcctl.NewServiceController(rpc) — effectively OpenSCManagerW — failed inside SmbExec. The classic access-denied: opening the Service Control Manager with the required rights needs local admin; also triggered by Remote UAC filtering elevated tokens of local (non-built-in) admin accounts over the network unless LocalAccountTokenFilterPolicy is 1.

Source

Thrown at pkg/js/libs/dcerpc/dcerpc.go:335

	if err := c.connect(); err != nil {
		return nil, err
	}

	pf, err := c.smb.OpenPipe("svcctl")
	if err != nil {
		return nil, fmt.Errorf("open svcctl pipe: %w", err)
	}
	defer func() {
		_ = pf.Close()
	}()

	rpc := gprpc.NewClient(pf)
	if err := rpc.Bind(gpsvcctl.UUID, gpsvcctl.MajorVersion, gpsvcctl.MinorVersion); err != nil {
		return nil, fmt.Errorf("svcctl bind: %w", err)
	}
	sc, err := gpsvcctl.NewServiceController(rpc)
	if err != nil {
		return nil, fmt.Errorf("svcctl open scm: %w", err)
	}
	defer sc.Close()

	res, err := gpsmbexec.Exec(sc, c.smb, command, gpsmbexec.Options{
		Share:   share,
		Mode:    gpsmbexec.ModeShare,
		Timeout: 10 * time.Second,
	})
	if err != nil {
		return nil, err
	}
	return &SmbExecResult{ServiceName: res.ServiceName, Output: res.Output}, nil
}


// AtExecResult is returned by AtExec.
type AtExecResult struct {
	TaskName string `json:"task_name"`

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Authenticate as (domain) administrator for the target.
2. For local accounts, set LocalAccountTokenFilterPolicy=1 on the target or use the built-in Administrator (RID 500) account.
3. Verify remotely with 'sc \\host query' from a Windows box to confirm SCM rights.
4. If admin is impossible, choose a module with lower requirements (WMI needs admin too — consider read-only enumeration instead).

Example fix

// before
const c = new dcerpc.Client('wk01', 'ACME', 'localuser', 'pass');
c.SmbExec('whoami', 'ADMIN$'); // svcctl open scm: ACCESS_DENIED

// after
const c = new dcerpc.Client('wk01', 'ACME', 'Administrator', 'adm-pass'); // admin or RID-500
c.SmbExec('whoami', 'ADMIN$');

try {
  const r = c.SmbExec(cmd, 'ADMIN$');
} catch (e) {
  const msg = String(e);
  if (msg.includes('svcctl open scm')) {
    // OpenSCManagerW denied: not admin, or Remote UAC filtering the token
    log('SCM access denied — admin rights required: ' + msg);
  } else throw e;
}

When it happens

Trigger: SmbExec with a non-admin account (ERROR_ACCESS_DENIED from OpenSCManagerW), or local-admin credentials on a client SKU where Remote UAC strips the admin token.

Common situations: Reused local-admin credentials on workstations hitting LocalAccountTokenFilterPolicy; domain users added to local Administrators; scans assuming admin but running as normal user.

Related errors

• svcctl open scm: %w
• encountered errors while performing template validation
• open pipe %q: %w
• samr connect: %w
• open svcctl pipe: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/47799eb2894b1a7f. Report an issue: GitHub.