{"record":{"id":"5b5bfb46bb7abccd","repo":"shadow1ng/fscan","slug":"ms17010-smbv1-unsupported","errorCode":null,"errorMessage":"ms17010_smbv1_unsupported","messagePattern":"ms17010_smbv1_unsupported","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"plugins/services/ms17010.go","lineNumber":313,"sourceCode":"\tif err != nil {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_connection_error\"), err)\n\t}\n\tdefer func() { _ = conn.Close() }()\n\n\tif err = conn.SetDeadline(time.Now().Add(session.Config.ModuleTimeout())); err != nil {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_set_timeout_error\"), err)\n\t}\n\n\t// SMB协议协商\n\tif _, err = conn.Write(negotiateProtocolRequest); err != nil {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_send_protocol_error\"), err)\n\t}\n\n\treply := make([]byte, 1024)\n\tn, readErr := conn.Read(reply)\n\tif readErr != nil || n < 36 {\n\t\t// 连接被关闭或响应不完整，通常表示目标不支持SMBv1\n\t\treturn false, \"\", false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_smbv1_unsupported\"))\n\t}\n\n\tif binary.LittleEndian.Uint32(reply[9:13]) != 0 {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_smbv1_rejected\"))\n\t}\n\n\t// 建立会话\n\tif _, err = conn.Write(sessionSetupRequest); err != nil {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_send_session_error\"), err)\n\t}\n\n\tn, readErr = conn.Read(reply)\n\tif readErr != nil || n < 36 {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_session_failed\"))\n\t}\n\n\tif binary.LittleEndian.Uint32(reply[9:13]) != 0 {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_session_rejected\"))","sourceCodeStart":295,"sourceCodeEnd":331,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L295-L331","documentation":"The MS17-10 checker opens a TCP connection to port 445 and sends an SMBv1 negotiate request. This error means the connection was closed by the peer or the SMB response header was shorter than the 36-byte minimum, so the target does not speak SMBv1. The library throws it to report 'not vulnerable / cannot test' for legacy-protocol-disabled hosts, not an internal failure.","triggerScenarios":"checkMS17010VulnerabilityAt returns this when conn.Read after sending the SMB negotiate request fails, or returns fewer than 36 bytes (the minimum NetBIOS+SMB header size).","commonSituations":"Target runs SMB2+ only (Windows 10 1709+, Server 2019 with SMB1 removed); a firewall sends TCP RST or silently drops after connect; a honeypot/middleware accepts the socket but closes it; the host is a non-Windows device with port 445 open (e.g. Samba with min protocol SMB2).","solutions":["Verify the target actually has SMBv1 enabled (Check with `Get-SmbServerConfiguration | Select EnableSMB1Protocol` on Windows); patch MS17-10 out-of-band if SMBv1 is off since EternalBlue requires SMBv1.","Confirm port 445 is reachable end-to-end (no stateful firewall/NAT RST); test with `nmap -p445 --script smb-protocols <host>`.","If scanning a modern Windows host, expect this error as a benign 'not exploitable via EternalBlue' outcome and treat it as non-vulnerable rather than retrying.","Retry once with a longer timeout if the network is lossy; a torn read under 36 bytes can look identical to a refused protocol."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"conn, err := net.DialTimeout(\"tcp\", host+\":445\", 3*time.Second)\nif err != nil { return err }\nconn.SetDeadline(time.Now().Add(5*time.Second))\n// optionally pre-check protocol support: nmap -p445 --script smb-protocols host","typeGuard":null,"tryCatchPattern":"vulnerable, os, extra, err := checkMS17010VulnerabilityAt(conn, ip)\nif err != nil {\n    if strings.Contains(err.Error(), \"ms17010_smbv1_unsupported\") {\n        // treat as not vulnerable via SMBv1; log and continue\n        return false\n    }\n    return err\n}","preventionTips":["Inventory SMB1 status on targets before scanning (EnableSMB1Protocol / smb.conf min protocol).","Expect this result on Windows 10 1709+/Server 2019 where SMBv1 is removed by default.","Do not retry blindly; the peer deliberately refuses or drops SMBv1.","Use an independent scanner to confirm patch state when SMBv1 is off."],"tags":["smb","network","ms17-10","scanning"],"backgroundTag":"smbv1-unsupported","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}