{"record":{"id":"21fb17bd3d1816ca","repo":"shadow1ng/fscan","slug":"invalid-message-type-0x-02x-in-smb1-response","errorCode":null,"errorMessage":"invalid message type 0x%02X in SMB1 response","messagePattern":"invalid message type 0x%02X in SMB1 response","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010_exp.go","lineNumber":196,"sourceCode":"\tReserved2       [2]byte\n\tTreeID          uint16\n\tProcessID       uint16\n\tUserID          uint16\n\tMultiplexID     uint16\n}\n\nfunc smb1GetResponse(conn net.Conn) ([]byte, *smbHeader, error) {\n\t// net BIOS\n\tbuf := make([]byte, 4)\n\t_, err := io.ReadFull(conn, buf)\n\tif err != nil {\n\t\tconst format = \"failed to get SMB1 response about NetBIOS session service: %s\"\n\t\treturn nil, nil, fmt.Errorf(format, err)\n\t}\n\ttyp := buf[0]\n\tif typ != 0x00 {\n\t\tconst format = \"invalid message type 0x%02X in SMB1 response\"\n\t\treturn nil, nil, fmt.Errorf(format, typ)\n\t}\n\tsizeBuf := make([]byte, 4)\n\tcopy(sizeBuf[1:], buf[1:])\n\tsize := int(binary.BigEndian.Uint32(sizeBuf))\n\t// 畸形响应（size < SMB 头长度）会导致后续 buf[:smbHeaderSize] 越界 panic\n\tif size < smbHeaderSize {\n\t\treturn nil, nil, fmt.Errorf(\"SMB1 response too short: %d bytes\", size)\n\t}\n\t// SMB\n\tbuf = make([]byte, size)\n\t_, err = io.ReadFull(conn, buf)\n\tif err != nil {\n\t\tconst format = \"failed to get SMB1 response about header: %s\"\n\t\treturn nil, nil, fmt.Errorf(format, err)\n\t}\n\tsmbHeader := smbHeader{}\n\treader := bytes.NewReader(buf[:smbHeaderSize])\n\terr = binary.Read(reader, binary.LittleEndian, &smbHeader)","sourceCodeStart":178,"sourceCodeEnd":214,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010_exp.go#L178-L214","documentation":"This error is returned by smb1GetResponse when the first byte of the NetBIOS session header is not 0x00 (the Session Message type) (plugins/services/ms17010_exp.go:196). NetBIOS session service uses 0x00 for session messages; other type bytes (e.g. 0x81 session request, 0x82/0x83 session keepalive/retarget, 0x85 session end) indicate the peer is not speaking the expected SMB-over-NetBIOS framing. The library throws it to fail fast on non-SMB or out-of-sync responses.","triggerScenarios":"Any smb1GetResponse caller receives 4 bytes whose first byte differs from 0x00 — e.g. connecting to a port that is not SMB/NetBIOS, a proxy answering with a different protocol, or the stream desynchronized so a payload byte is read as the type byte.","commonSituations":"Pointing the scanner at the wrong port (139 vs 445 confusion, or a non-SMB service); MITM proxies/honeypots replying with NetBIOS session-request negatives (0x82/0x83); prior malformed response leaving extra bytes in the stream.","solutions":["Verify the target address/port actually hosts an SMB service speaking NetBIOS framing","Look at the printed type byte: 0x8x values are NetBIOS control messages (negative session response = server refusing), indicating the server rejected the session","Re-establish a fresh connection; a desynchronized stream cannot recover mid-session","If scanning port 139, ensure the NetBIOS session request handshake is performed before SMB negotiation"],"exampleFix":"// before\ntyp := buf[0]\nif typ != 0x00 {\n    return nil, nil, fmt.Errorf(\"invalid message type 0x%02X in SMB1 response\", typ)\n}\n// after\ntyp := buf[0]\nif typ != 0x00 {\n    return nil, nil, fmt.Errorf(\"invalid message type 0x%02X in SMB1 response (expected 0x00 session message; 0x8x = NetBIOS control)\", typ)\n}","handlingStrategy":"validation","validationCode":"// Pre-check that the endpoint answers SMB-style NetBIOS framing\nfunc looksLikeSMB(address string) bool {\n    conn, err := net.DialTimeout(\"tcp\", address, 5*time.Second)\n    if err != nil { return false }\n    defer conn.Close()\n    _ = conn.SetReadDeadline(time.Now().Add(5 * time.Second))\n    if err := smbClientNegotiate(conn); err != nil {\n        return !strings.Contains(err.Error(), \"invalid message type\")\n    }\n    return true\n}","typeGuard":null,"tryCatchPattern":"_, _, err := smb1GetResponse(conn)\nif err != nil {\n    var bad byte\n    if n, _ := fmt.Sscanf(err.Error(), \"invalid message type 0x%02X in SMB1 response\", &bad); n == 1 && bad&0x80 != 0 {\n        // NetBIOS control (e.g. negative session response): server refused the session\n        return classifyHost(\"netbios-refused\")\n    }\n    return classifyHost(\"not-smb\")\n}","preventionTips":["Confirm the port hosts SMB before connecting (445 directly; 139 needs a NetBIOS session request first)","Treat 0x8x type bytes as meaningful: 0x82/0x83 = negative session response from the server","Never continue reading on a desynchronized stream — reconnect instead","Honeypots often reply with junk frames; flag and skip such hosts"],"tags":["smb","netbios","protocol-violation","framing","smb1"],"backgroundTag":"invalid-enum-value","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}