{"record":{"id":"263fdbe04ebaf440","repo":"shadow1ng/fscan","slug":"failed-to-parse-smb1-response-header-s","errorCode":null,"errorMessage":"failed to parse SMB1 response header: %s","messagePattern":"failed to parse SMB1 response header: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010_exp.go","lineNumber":217,"sourceCode":"\tcopy(sizeBuf[1:], buf[1:])\n\tsize := int(binary.BigEndian.Uint32(sizeBuf))\n\t// 畸形响应（size < SMB 头长度）会导致后续 buf[:smbHeaderSize] 越界 panic\n\tif size < smbHeaderSize {\n\t\treturn nil, nil, fmt.Errorf(\"SMB1 response too short: %d bytes\", size)\n\t}\n\t// SMB\n\tbuf = make([]byte, size)\n\t_, err = io.ReadFull(conn, buf)\n\tif err != nil {\n\t\tconst format = \"failed to get SMB1 response about header: %s\"\n\t\treturn nil, nil, fmt.Errorf(format, err)\n\t}\n\tsmbHeader := smbHeader{}\n\treader := bytes.NewReader(buf[:smbHeaderSize])\n\terr = binary.Read(reader, binary.LittleEndian, &smbHeader)\n\tif err != nil {\n\t\tconst format = \"failed to parse SMB1 response header: %s\"\n\t\treturn nil, nil, fmt.Errorf(format, err)\n\t}\n\treturn buf, &smbHeader, nil\n}\n\nfunc smbClientNegotiate(conn net.Conn) error {\n\tbuf := bytes.Buffer{}\n\n\t// --------NetBIOS Session Service--------\n\n\t// message type\n\tbuf.WriteByte(0x00)\n\t// length\n\tbuf.Write([]byte{0x00, 0x00, 0x54})\n\n\t// --------Server Message Block Protocol--------\n\n\t// server_component: .SMB\n\tbuf.Write([]byte{0xFF, 0x53, 0x4D, 0x42})","sourceCodeStart":199,"sourceCodeEnd":235,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010_exp.go#L199-L235","documentation":"smb1GetResponse reads the fixed-size SMB1 header from the connection and parses it into an smbHeader struct with binary.Read. If the bytes on the wire do not fit the smbHeader layout (connection closed early, non-SMB response, or truncated read), the function returns this wrapped error. It is a low-level protocol parse failure inside the MS17-010 (EternalBlue) exploit plugin.","triggerScenarios":"Calling any of exploit, smbClientNegotiate, smb1AnonymousLogin, treeConnectAndX, smb1LargeBuffer, or sendNTTrans against a target whose reply is not a valid SMB1 header — e.g. the host closed the TCP connection before smbHeaderSize bytes arrived, a non-Windows service answered on port 445, or a middlebox reset the stream mid-response.","commonSituations":"Scanning a host that speaks SMB2/SMB3 only (SMB1 disabled on modern Windows), port 445 mapped to a honeypot or proxy, or flaky network links that truncate the read.","solutions":["Verify the target actually supports SMB1 (nmblookup/nmap smb-protocols) before running the exploit","Check that port 445 is reachable and not proxied by a non-SMB service","Retry the scan; transient truncation of the response stream causes spurious parse failures","If auditing code, confirm the read loop fills the full smbHeaderSize buffer before binary.Read"],"exampleFix":"// before\nbuf := make([]byte, smbHeaderSize)\nio.ReadFull(conn, buf) // may return short data ignored\n// after\nif _, err := io.ReadFull(conn, buf); err != nil {\n    return nil, nil, fmt.Errorf(\"short SMB1 header read: %w\", err)\n}","handlingStrategy":"retry","validationCode":"// probe SMB1 before running the exploit\nfunc supportsSMB1(host string, port int) bool {\n    conn, err := net.DialTimeout(\"tcp\", fmt.Sprintf(\"%s:%d\", host, port), 5*time.Second)\n    if err != nil { return false }\n    defer conn.Close()\n    conn.Write(makeSMB1NegotiateProbe())\n    buf := make([]byte, smbHeaderSize)\n    _, err = io.ReadFull(conn, buf)\n    return err == nil\n}","typeGuard":"func isSMBHeader(buf []byte) bool {\n    return len(buf) >= smbHeaderSize && binary.LittleEndian.Uint32(buf[0:4]) == smbMagic\n}","tryCatchPattern":"buf, hdr, err := smb1GetResponse(conn)\nif err != nil {\n    var nerr net.Error\n    if errors.As(err, &nerr) && nerr.Timeout() {\n        // retry once with longer deadline\n    }\n    return fmt.Errorf(\"smb1 response unavailable: %w\", err)\n}","preventionTips":["Confirm SMB1 is enabled on the target before exploiting","Use io.ReadFull so short reads are surfaced as distinct errors","Set generous read deadlines for slow links","Test with a known-good SMB1 host to separate code bugs from target issues"],"tags":["network","smb","go","exploit"],"backgroundTag":"invalid-json-response","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}