{"record":{"id":"3cea732cac74a548","repo":"shadow1ng/fscan","slug":"failed-to-get-smb1-response-about-netbios-session","errorCode":null,"errorMessage":"failed to get SMB1 response about NetBIOS session service: %s","messagePattern":"failed to get SMB1 response about NetBIOS session service: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010_exp.go","lineNumber":191,"sourceCode":"\tErrorCode       uint16\n\tFlags           uint8\n\tFlags2          uint16\n\tProcessIDHigh   uint16\n\tSignature       [8]byte\n\tReserved2       [2]byte\n\tTreeID          uint16\n\tProcessID       uint16\n\tUserID          uint16\n\tMultiplexID     uint16\n}\n\nfunc smb1GetResponse(conn net.Conn) ([]byte, *smbHeader, error) {\n\t// net BIOS\n\tbuf := make([]byte, 4)\n\t_, err := io.ReadFull(conn, buf)\n\tif err != nil {\n\t\tconst format = \"failed to get SMB1 response about NetBIOS session service: %s\"\n\t\treturn nil, nil, fmt.Errorf(format, err)\n\t}\n\ttyp := buf[0]\n\tif typ != 0x00 {\n\t\tconst format = \"invalid message type 0x%02X in SMB1 response\"\n\t\treturn nil, nil, fmt.Errorf(format, typ)\n\t}\n\tsizeBuf := make([]byte, 4)\n\tcopy(sizeBuf[1:], buf[1:])\n\tsize := int(binary.BigEndian.Uint32(sizeBuf))\n\t// 畸形响应（size < SMB 头长度）会导致后续 buf[:smbHeaderSize] 越界 panic\n\tif size < smbHeaderSize {\n\t\treturn nil, nil, fmt.Errorf(\"SMB1 response too short: %d bytes\", size)\n\t}\n\t// SMB\n\tbuf = make([]byte, size)\n\t_, err = io.ReadFull(conn, buf)\n\tif err != nil {\n\t\tconst format = \"failed to get SMB1 response about header: %s\"","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010_exp.go#L173-L209","documentation":"This error is returned by smb1GetResponse when reading the 4-byte NetBIOS session-service header from the connection fails (plugins/services/ms17010_exp.go:191). It uses io.ReadFull, so any short read, connection close, or deadline expiry before 4 bytes arrive is wrapped here. The library throws it because no SMB frame can be interpreted without the NetBIOS length header.","triggerScenarios":"Any caller of smb1GetResponse (exploit, smbClientNegotiate, smb1AnonymousLogin, treeConnectAndX, smb1LargeBuffer, sendNTTrans, smb1FreeHole) whose peer closes/resets the TCP connection before sending a reply, or whose read deadline (10s via SetReadDeadline) expires with no data.","commonSituations":"Patched hosts that kill the connection upon receiving EternalBlue probe/exploit packets; target overloaded and not answering within the 10s deadline; firewall silently dropping the established session; server closed socket after previous malformed request.","solutions":["Check the wrapped error: io.EOF/RESET means the peer closed — likely non-vulnerable or rate-limiting; os.ErrDeadlineExceeded means slow/no response","Retry the operation; transient drops are common in scanning","Verify SMB1 connectivity with a simple negotiate/echo probe before running heavier stages","Extend the read deadline for slow targets if you control the calling code"],"exampleFix":"// before\n_, err := io.ReadFull(conn, buf)\nif err != nil {\n    return nil, nil, fmt.Errorf(\"failed to get SMB1 response about NetBIOS session service: %s\", err)\n}\n// after\n_, err := io.ReadFull(conn, buf)\nif err != nil {\n    if errors.Is(err, os.ErrDeadlineExceeded) {\n        return nil, nil, fmt.Errorf(\"target did not answer within deadline (NetBIOS header): %w\", err)\n    }\n    return nil, nil, fmt.Errorf(\"failed to get SMB1 response about NetBIOS session service: %w\", err)\n}","handlingStrategy":"retry","validationCode":"// Confirm a full SMB1 round trip works before heavier stages\nfunc probeSMB1(address string) error {\n    conn, err := net.DialTimeout(\"tcp\", address, 10*time.Second)\n    if err != nil { return err }\n    defer conn.Close()\n    _ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))\n    if err := smbClientNegotiate(conn); err != nil { return err }\n    return nil\n}","typeGuard":"func isPeerClosedOrTimeout(err error) bool {\n    return errors.Is(err, io.EOF) ||\n        errors.Is(err, io.ErrUnexpectedEOF) ||\n        errors.Is(err, os.ErrDeadlineExceeded) ||\n        errors.Is(err, syscall.ECONNRESET)\n}","tryCatchPattern":"raw, header, err := smb1GetResponse(conn)\nif err != nil {\n    if isPeerClosedOrTimeout(err) {\n        return retryWithFreshConnection() // peer dropped us; retry elsewhere\n    }\n    return err\n}","preventionTips":["Always set a read deadline before any smb1GetResponse call — the library does not set one itself","Never reuse a connection after this error; the NetBIOS framing is unrecoverable","Expect connection kills from patched hosts — treat as a negative signal, not a bug","Retry transient timeouts once before marking a host failed"],"tags":["network","smb","netbios","read-timeout","connection-closed"],"backgroundTag":"broken-pipe","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}