projectdiscovery/nuclei · error

tsch bind: %w

Error message

tsch bind: %w

What it means

After atsvc opened, rpc.BindAuth to the Task Scheduler (tsch) interface failed — the authenticated bind was rejected: invalid credentials inside the altered bind, the SchRpc interface not served, or Kerberos problems (time skew, KDC unreachable) after SetKerberos(). Distinct from 212: the pipe exists; the bind/auth exchange failed.

Source

Thrown at pkg/js/libs/dcerpc/dcerpc.go:394

// ```
func (c *Client) AtExec(command, share string) (*AtExecResult, error) {
	c.nj.Require(command != "", "command cannot be empty")
	if !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {
		return nil, protocolstate.ErrHostDenied.Msgf(c.Host)
	}
	if err := c.connect(); err != nil {
		return nil, err
	}

	pf, err := c.smb.OpenPipe("atsvc")
	if err != nil {
		return nil, fmt.Errorf("open atsvc pipe: %w", err)
	}
	defer func() { _ = pf.Close() }()

	rpc := gprpc.NewClient(pf)
	if err := rpc.BindAuth(gptsch.UUID, gptsch.MajorVersion, gptsch.MinorVersion, c.creds); err != nil {
		return nil, fmt.Errorf("tsch bind: %w", err)
	}
	ts := gptsch.NewTaskScheduler(rpc)

	res, err := gpatexec.Exec(ts, c.smb, command, gpatexec.Options{
		Share:     share,
		Timeout:   15 * time.Second,
		SessionID: -1,
	})
	if err != nil {
		return nil, err
	}
	return &AtExecResult{TaskName: res.TaskName, Output: res.Output}, nil
}

// SmbListShares enumerates the SMB shares exposed by the target.
//
// @example
// ```javascript

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Verify credentials with a known-good hash via SetHash().
2. Check the domain string and clock sync when Kerberos is enabled.
3. Confirm the Task Scheduler service and atsvc endpoint with RpcDump.
4. Fall back to SmbExec if tsch refuses binds.

Example fix

// before
const c = new dcerpc.Client('dc01', 'ACME', 'adm', 'bad-pass');
c.AtExec('whoami', 'C$'); // tsch bind: STATUS_LOGON_FAILURE

// after
const c = new dcerpc.Client('dc01', 'ACME', 'adm', '');
c.SetHash('aad3b435b51404eeaad3b435b51404ee:<valid-nt>');
c.AtExec('whoami', 'C$');

try {
  const r = c.AtExec(cmd, 'C$');
} catch (e) {
  const msg = String(e);
  if (msg.includes('tsch bind')) {
    // authenticated bind to Task Scheduler rejected: credential/Kerberos issue
    log('tsch bind rejected: ' + msg);
  } else throw e;
}

When it happens

Trigger: AtExec with a wrong password producing a bind-time logon failure, a wrong domain string, or SetKerberos with skewed clocks / unreachable DC.

Common situations: Credential typos only surfacing at RPC bind (SMB allowed the session via different flags); NTLM-disabled environments; Kerberos environments with NTP drift.

Related errors

• dcerpc bind: %w
• smb connect: %w
• lsa init: %w
• drsuapi bind: %w
• domain controller denied by network policy

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/0923107f4086cdd9. Report an issue: GitHub.