{"record":{"id":"6294f3d50b101e6e","repo":"shadow1ng/fscan","slug":"ntlm-hash-authentication-failed","errorCode":null,"errorMessage":"NTLM hash authentication failed","messagePattern":"NTLM hash authentication failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ldap.go","lineNumber":198,"sourceCode":"\tstopCancelClose := context.AfterFunc(ctx, func() {\n\t\t_ = conn.Close()\n\t})\n\tdefer stopCancelClose()\n\n\tif err := conn.NTLMBindWithHash(domain, username, hash); err == nil {\n\t\treturn &AuthResult{\n\t\t\tSuccess:   true,\n\t\t\tConn:      &ldapConnWrapper{conn},\n\t\t\tErrorType: ErrorTypeUnknown,\n\t\t\tError:     nil,\n\t\t}\n\t}\n\n\t_ = conn.Close()\n\treturn &AuthResult{\n\t\tSuccess:   false,\n\t\tErrorType: ErrorTypeAuth,\n\t\tError:     fmt.Errorf(\"NTLM hash authentication failed\"),\n\t}\n}\n\n// connectLDAP 连接LDAP服务器\nfunc (p *LDAPPlugin) connectLDAP(ctx context.Context, info *common.HostInfo, session *common.ScanSession) (*ldaplib.Conn, error) {\n\ttarget := info.Target()\n\n\ttype result struct {\n\t\tconn *ldaplib.Conn\n\t\terr  error\n\t}\n\tresultChan := make(chan result, 1)\n\n\tgo func() {\n\t\ttcpConn, err := session.DialTCP(ctx, \"tcp\", target, session.Config.ModuleTimeout())\n\t\tif err != nil {\n\t\t\tresultChan <- result{nil, err}\n\t\t\treturn","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ldap.go#L180-L216","documentation":"Guard in doNTLMHashAuth: NTLMBindWithHash failed, so pass-the-hash authentication with the provided domain/username/NTLM-hash combination was rejected by the LDAP server. The connection is closed and the attempt is classified as ErrorTypeAuth (bad hash, wrong domain, or NTLM not permitted).","triggerScenarios":"Thrown at plugins/services/ldap.go:198 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the NTLM hash is the correct format (32 hex chars) and matches the account","Confirm the domain component is correct for the target AD forest","Check whether the account is locked out or NTLM authentication is disabled by policy"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}