{"record":{"id":"46e8a541e5f017c8","repo":"shadow1ng/fscan","slug":"ms17010-read-pipe-error-w","errorCode":null,"errorMessage":"ms17010_read_pipe_error: %w","messagePattern":"ms17010_read_pipe_error: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010.go","lineNumber":383,"sourceCode":"\t\treturn false, osVersion, false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_tree_response_incomplete\"))\n\t}\n\n\t// 命名管道请求\n\ttreeID := reply[28:30]\n\ttransNamedPipe := append([]byte(nil), transNamedPipeRequest...)\n\ttransNamedPipe[28] = treeID[0]\n\ttransNamedPipe[29] = treeID[1]\n\ttransNamedPipe[32] = userID[0]\n\ttransNamedPipe[33] = userID[1]\n\n\tif _, err = conn.Write(transNamedPipe); err != nil {\n\t\treturn false, osVersion, false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_send_pipe_error\"), err)\n\t}\n\n\tn, readErr = conn.Read(reply)\n\tif readErr != nil || n < 36 {\n\t\tif readErr != nil {\n\t\t\treturn false, osVersion, false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_read_pipe_error\"), readErr)\n\t\t}\n\t\treturn false, osVersion, false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_pipe_response_incomplete\"))\n\t}\n\n\t// 漏洞检测 - 关键检查点\n\tif reply[9] == 0x05 && reply[10] == 0x02 && reply[11] == 0x00 && reply[12] == 0xc0 {\n\t\ttrans2SessionSetup := append([]byte(nil), trans2SessionSetupRequest...)\n\t\ttrans2SessionSetup[28] = treeID[0]\n\t\ttrans2SessionSetup[29] = treeID[1]\n\t\ttrans2SessionSetup[32] = userID[0]\n\t\ttrans2SessionSetup[33] = userID[1]\n\n\t\tif _, err = conn.Write(trans2SessionSetup); err != nil {\n\t\t\treturn true, osVersion, false, nil\n\t\t}\n\t\tn, readErr = conn.Read(reply)\n\t\tif readErr != nil || n < 36 {\n\t\t\treturn true, osVersion, false, nil","sourceCodeStart":365,"sourceCodeEnd":401,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L365-L401","documentation":"The Trans named-pipe request was sent but the read of the response failed outright. This variant wraps the underlying read error (%w), as opposed to the incomplete-response sibling, and means the vulnerability-detection reply (which should echo status 0x05 0x02 0x00 0xc0 = STATUS_INSUFF_SERVER_RESOURCES on vulnerable hosts) never arrived.","triggerScenarios":"checkMS17010VulnerabilityAt returns this when conn.Read(reply) after the transNamedPipe write returns a non-nil readErr.","commonSituations":"Read deadline expires because the server throttles or drops srvsvc Trans requests; IPS resets the flow on the exploit-shaped probe; server crashes processing the malformed-for-old-patches request (which itself is a vuln hint); packet loss.","solutions":["Raise the read deadline and retry — vulnerable hosts that crash-and-reset the connection should be re-probed and cross-checked, since a reset on this exact request is a strong vulnerability indicator.","Unwrap the cause: ECONNRESET here, on an unpatched legacy host, often means the srvsvc handling crashed — verify manually with `nmap --script smb-vuln-ms17-010`.","Exclude IPS interference by scanning from a allow-listed host.","If the host never answers the pipe probe, mark inconclusive and verify patch level (KB4013389 and later) via other means."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"conn.SetReadDeadline(time.Now().Add(readTimeout))\n// buffer big enough: reply := make([]byte, 1024)\nif n, err := conn.Read(reply); err != nil { /* retry; note ECONNRESET here may indicate vulnerability */ }","typeGuard":null,"tryCatchPattern":"n, readErr := conn.Read(reply)\nif readErr != nil {\n    if errors.Is(readErr, syscall.ECONNRESET) {\n        // srvsvc handler may have crashed — strong MS17-10 hint; flag for manual check\n    }\n    return fmt.Errorf(\"pipe probe read failed: %w\", readErr)\n}","preventionTips":["Interpret ECONNRESET on this specific request as a possible vulnerability signal, not just noise.","Retry and cross-check with nmap smb-vuln-ms17-010 before concluding.","Increase read deadlines; throttled servers may answer late.","Allow-list scanner IPs to rule out IPS resets on exploit-shaped probes."],"tags":["smb","named-pipe","network","ms17-10","vulnerability-scan"],"backgroundTag":"network-request-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}