{"record":{"id":"6273ab9061c5339a","repo":"shadow1ng/fscan","slug":"failed-to-negotiate-s","errorCode":null,"errorMessage":"failed to negotiate: %s","messagePattern":"failed to negotiate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010_exp.go","lineNumber":147,"sourceCode":"\tbuf.Write(size)\n\tbuf.Write(sc)\n\treturn buf.Bytes()\n}\n\nfunc smb1AnonymousConnectIPC(address string) (*smbHeader, net.Conn, error) {\n\tconn, err := net.DialTimeout(\"tcp\", address, 10*time.Second)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to connect host: %s\", err)\n\t}\n\tvar ok bool\n\tdefer func() {\n\t\tif !ok {\n\t\t\t_ = conn.Close()\n\t\t}\n\t}()\n\terr = smbClientNegotiate(conn)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to negotiate: %s\", err)\n\t}\n\traw, header, err := smb1AnonymousLogin(conn)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to login with anonymous: %s\", err)\n\t}\n\t_, err = getOSName(raw)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to get OS name: %s\", err)\n\t}\n\t//fmt.Println(\"OS:\", osName)\n\theader, err = treeConnectAndX(conn, address, header.UserID)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to tree connect AndX: %s\", err)\n\t}\n\tok = true\n\treturn header, conn, nil\n}\n","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010_exp.go#L129-L165","documentation":"This error wraps a failure of smbClientNegotiate during smb1AnonymousConnectIPC (plugins/services/ms17010_exp.go:147). Negotiation sends a hardcoded SMB1 Negotiate Protocol request and reads the reply via smb1GetResponse; any transport failure or malformed reply is surfaced here. It means the TCP connection was established but the SMB protocol handshake did not complete.","triggerScenarios":"smbClientNegotiate's buf.WriteTo(conn) fails (peer reset the connection right after accept), or smb1GetResponse fails: NetBIOS read error/timeout, non-zero message type byte, response shorter than the 32-byte SMB header, short read, or unparseable header.","commonSituations":"Target is not an SMB service (some other daemon on 445 answering garbage); honeypots or proxies that accept TCP then close; SMB servers that immediately negotiate SMB2-only and drop SMB1 clients; rate-limiting devices resetting sessions.","solutions":["Confirm the port actually speaks SMB (banner/protocol detection) rather than assuming 445 is SMB","Check whether the target supports SMB1; if it is SMB2-only, this SMB1-based exploit path will not work","Inspect the wrapped smb1GetResponse error to distinguish timeout (retry) vs reset (target refusing SMB1)","Retry with backoff; transient resets during mass scanning are common"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Confirm SMB1 negotiation works on a throwaway connection first\nfunc canNegotiateSMB1(address string) bool {\n    conn, err := net.DialTimeout(\"tcp\", address, 10*time.Second)\n    if err != nil { return false }\n    defer conn.Close()\n    _ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))\n    return smbClientNegotiate(conn) == nil\n}","typeGuard":"func isNegotiateFailure(err error) bool {\n    return strings.HasPrefix(err.Error(), \"failed to negotiate:\")\n}","tryCatchPattern":"for attempt := 0; attempt < 3; attempt++ {\n    header, conn, err := smb1AnonymousConnectIPC(addr)\n    if err == nil { use(conn); return }\n    if !isNegotiateFailure(err) { return err } // only retry negotiate failures\n    time.Sleep(time.Duration(1<<attempt) * time.Second)\n}","preventionTips":["Verify the port speaks SMB, not some other protocol, before SMB-level operations","Accept that SMB2-only hosts can never pass this stage; exclude them","Back off between retries to avoid tripping rate limiters","Fresh connection per retry — a failed negotiate leaves the stream unusable"],"tags":["smb","protocol-negotiation","network","smb1","handshake"],"backgroundTag":"http-error-response","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}