{"record":{"id":"2ddb13dca3aeceaa","repo":"shadow1ng/fscan","slug":"ms17010-connection-error-w","errorCode":null,"errorMessage":"ms17010_connection_error: %w","messagePattern":"ms17010_connection_error: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010.go","lineNumber":296,"sourceCode":"\t\tcommon.LogError(i18n.Tr(\"ms17010_pipe_decrypt_error\", err))\n\t\treturn\n\t}\n\ttrans2SessionSetupRequest, err = hex.DecodeString(decrypted)\n\tif err != nil {\n\t\tcommon.LogError(i18n.Tr(\"ms17010_pipe_decode_error\", err))\n\t\treturn\n\t}\n}\n\n// checkMS17010Vulnerability 检测MS17-010漏洞 (从原始MS17010.go复制和适配)\nfunc (p *MS17010Plugin) checkMS17010Vulnerability(ctx context.Context, ip string, session *common.ScanSession) (bool, string, bool, error) {\n\treturn p.checkMS17010VulnerabilityAt(ctx, net.JoinHostPort(ip, \"445\"), session)\n}\n\nfunc (p *MS17010Plugin) checkMS17010VulnerabilityAt(ctx context.Context, address string, session *common.ScanSession) (bool, string, bool, error) {\n\tconn, err := session.DialTCP(ctx, \"tcp\", address, session.Config.ModuleTimeout())\n\tif err != nil {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_connection_error\"), err)\n\t}\n\tdefer func() { _ = conn.Close() }()\n\n\tif err = conn.SetDeadline(time.Now().Add(session.Config.ModuleTimeout())); err != nil {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_set_timeout_error\"), err)\n\t}\n\n\t// SMB协议协商\n\tif _, err = conn.Write(negotiateProtocolRequest); err != nil {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_send_protocol_error\"), err)\n\t}\n\n\treply := make([]byte, 1024)\n\tn, readErr := conn.Read(reply)\n\tif readErr != nil || n < 36 {\n\t\t// 连接被关闭或响应不完整，通常表示目标不支持SMBv1\n\t\treturn false, \"\", false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_smbv1_unsupported\"))\n\t}","sourceCodeStart":278,"sourceCodeEnd":314,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L278-L314","documentation":"checkMS17010VulnerabilityAt wraps the DialTCP failure to the target's port 445 with \"ms17010_connection_error\" plus the underlying OS error. The MS17-010 probe cannot even establish a TCP connection, so no vulnerability assessment is possible and Scan/Exploit surface this wrapped error.","triggerScenarios":"session.DialTCP(ctx, \"tcp\", ip:445, timeout) fails because the port is closed, the host is down/unreachable, a firewall drops the SYN, or DNS/routing for the IP is wrong.","commonSituations":"Scanning hosts where SMB (445) is firewalled, scanning offline machines, wrong subnet/VPN not connected, or Windows Defender Firewall blocking inbound 445 from the scanner.","solutions":["Check the unwrapped cause (errors.Unwrap): 'connection refused' means host up but 445 closed; 'i/o timeout'/'no route to host' means network/firewall.","Verify port 445 is open from the scanner host: nc -vz <ip> 445 or nmap -p445 <ip>.","Exclude unreachable hosts from the MS17-10 scan list or pre-check connectivity with the same DialTCP call.","Fix routing/firewall: allow inbound 445 on the target or run the scanner from a network segment with access."],"exampleFix":"// before: treating all failures the same\nres := plugin.Scan(ctx, host, session)\nif res.Error != nil { log.Fatal(res.Error) }\n// after: distinguish connection errors\nif res.Error != nil && strings.Contains(res.Error.Error(), \"connection\") {\n    log.Printf(\"host %s unreachable on 445, skipping\", host.Host)\n} else if res.Error != nil {\n    log.Printf(\"probe error: %v\", res.Error)\n}","handlingStrategy":"retry","validationCode":"conn, err := net.DialTimeout(\"tcp\", net.JoinHostPort(host, \"445\"), 3*time.Second)\nif err != nil { return fmt.Errorf(\"%s:445 unreachable, skipping ms17010\", host) }\n_ = conn.Close()","typeGuard":null,"tryCatchPattern":"if err != nil {\n    var netErr net.Error\n    if errors.As(err, &netErr) && netErr.Timeout() {\n        return fmt.Errorf(\"target 445 filtered/timeout: %w\", err)\n    }\n    return err\n}","preventionTips":["Pre-check port 445 reachability before running the plugin","Classify refused vs timeout vs no-route to decide skip vs retry","Keep scanner and targets on routable networks (VPN up, firewall allows 445)"],"tags":["go","network","tcp","smb","connection","ms17010"],"backgroundTag":"connection-refused","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}