{"record":{"id":"a64473d09870a610","repo":"shadow1ng/fscan","slug":"failed-to-tree-connect-andx-s","errorCode":null,"errorMessage":"failed to tree connect AndX: %s","messagePattern":"failed to tree connect AndX: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010_exp.go","lineNumber":160,"sourceCode":"\t\t\t_ = conn.Close()\n\t\t}\n\t}()\n\terr = smbClientNegotiate(conn)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to negotiate: %s\", err)\n\t}\n\traw, header, err := smb1AnonymousLogin(conn)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to login with anonymous: %s\", err)\n\t}\n\t_, err = getOSName(raw)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to get OS name: %s\", err)\n\t}\n\t//fmt.Println(\"OS:\", osName)\n\theader, err = treeConnectAndX(conn, address, header.UserID)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to tree connect AndX: %s\", err)\n\t}\n\tok = true\n\treturn header, conn, nil\n}\n\nconst smbHeaderSize = 32\n\ntype smbHeader struct {\n\tServerComponent [4]byte\n\tSMBCommand      uint8\n\tErrorClass      uint8\n\tReserved        byte\n\tErrorCode       uint16\n\tFlags           uint8\n\tFlags2          uint16\n\tProcessIDHigh   uint16\n\tSignature       [8]byte\n\tReserved2       [2]byte","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010_exp.go#L142-L178","documentation":"This error wraps a failure of treeConnectAndX in smb1AnonymousConnectIPC (plugins/services/ms17010_exp.go:160). treeConnectAndX sends an SMB1 Tree Connect AndX request for \\\\host\\IPC$ using the logged-in UserID and reads the reply via smb1GetResponse; it can also fail earlier if net.SplitHostPort cannot split the address. The library throws it because the exploit needs an established IPC$ tree (TreeID) before staging the Trans2 packets.","triggerScenarios":"net.SplitHostPort fails on a malformed address (no host:port form), the packet write fails, or smb1GetResponse fails on the tree-connect reply (NetBIOS read error/timeout, invalid message type, response shorter than 32 bytes, incomplete body, unparseable header).","commonSituations":"Address passed without a port (e.g. \"10.0.0.5\" instead of \"10.0.0.5:445\"); server denies access to IPC$ even for anonymous sessions; connection dropped mid-session by the target or an IDS; timeouts on slow targets.","solutions":["Ensure the address is in host:port form — a missing port makes SplitHostPort fail before anything is sent","Check the tree-connect response's NT status; ACCESS_DENIED means IPC$ null sessions are blocked on the target","Inspect the wrapped smb1GetResponse error for reset vs timeout and retry accordingly","Confirm the anonymous login succeeded (valid UserID) since an invalid UserID can cause the tree connect to be rejected"],"exampleFix":"// before\nheader, err = treeConnectAndX(conn, address, header.UserID)\nif err != nil {\n    return nil, nil, fmt.Errorf(\"failed to tree connect AndX: %s\", err)\n}\n// after\nif _, _, err := net.SplitHostPort(address); err != nil {\n    return nil, nil, fmt.Errorf(\"invalid address %q (want host:port): %w\", address, err)\n}\nheader, err = treeConnectAndX(conn, address, header.UserID)\nif err != nil {\n    return nil, nil, fmt.Errorf(\"failed to tree connect AndX: %w\", err)\n}","handlingStrategy":"validation","validationCode":"func validTargetAddress(address string) error {\n    host, port, err := net.SplitHostPort(address)\n    if err != nil {\n        return fmt.Errorf(\"address %q must be host:port: %w\", address, err)\n    }\n    if net.ParseIP(host) == nil {\n        return fmt.Errorf(\"host %q is not an IP\", host)\n    }\n    _, err = strconv.Atoi(port)\n    return err\n}","typeGuard":"func isAddressFormatErr(err error) bool {\n    var addrErr *net.AddrError\n    return errors.As(err, &addrErr) && addrErr.Err == \"missing port in address\"\n}","tryCatchPattern":"header, conn, err := smb1AnonymousConnectIPC(addr)\nif err != nil {\n    if isAddressFormatErr(err) || strings.Contains(err.Error(), \"failed to tree connect AndX\") && missingPort(addr) {\n        addr = net.JoinHostPort(addr, \"445\")\n        return smb1AnonymousConnectIPC(addr)\n    }\n    return err\n}","preventionTips":["Always normalize target addresses to host:port before invoking the exploit chain","Check IPC$ accessibility (null-session policy) on Windows targets beforehand","Inspect the tree-connect NT status in the response to distinguish ACCESS_DENIED from transport failure","Reuse the negotiated UserID from login — expired/invalid UserIDs cause rejections"],"tags":["smb","smb1","tree-connect","ipc","network"],"backgroundTag":"permission-denied","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}