{"record":{"id":"ada8cdb6059f0f4a","repo":"shadow1ng/fscan","slug":"ms17010-send-pipe-error-w","errorCode":null,"errorMessage":"ms17010_send_pipe_error: %w","messagePattern":"ms17010_send_pipe_error: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010.go","lineNumber":377,"sourceCode":"\n\tn, readErr = conn.Read(reply)\n\tif readErr != nil || n < 36 {\n\t\tif readErr != nil {\n\t\t\treturn false, osVersion, false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_read_tree_error\"), readErr)\n\t\t}\n\t\treturn false, osVersion, false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_tree_response_incomplete\"))\n\t}\n\n\t// 命名管道请求\n\ttreeID := reply[28:30]\n\ttransNamedPipe := append([]byte(nil), transNamedPipeRequest...)\n\ttransNamedPipe[28] = treeID[0]\n\ttransNamedPipe[29] = treeID[1]\n\ttransNamedPipe[32] = userID[0]\n\ttransNamedPipe[33] = userID[1]\n\n\tif _, err = conn.Write(transNamedPipe); err != nil {\n\t\treturn false, osVersion, false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_send_pipe_error\"), err)\n\t}\n\n\tn, readErr = conn.Read(reply)\n\tif readErr != nil || n < 36 {\n\t\tif readErr != nil {\n\t\t\treturn false, osVersion, false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_read_pipe_error\"), readErr)\n\t\t}\n\t\treturn false, osVersion, false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_pipe_response_incomplete\"))\n\t}\n\n\t// 漏洞检测 - 关键检查点\n\tif reply[9] == 0x05 && reply[10] == 0x02 && reply[11] == 0x00 && reply[12] == 0xc0 {\n\t\ttrans2SessionSetup := append([]byte(nil), trans2SessionSetupRequest...)\n\t\ttrans2SessionSetup[28] = treeID[0]\n\t\ttrans2SessionSetup[29] = treeID[1]\n\t\ttrans2SessionSetup[32] = userID[0]\n\t\ttrans2SessionSetup[33] = userID[1]\n","sourceCodeStart":359,"sourceCodeEnd":395,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L359-L395","documentation":"After the tree connect, the checker writes a Trans request targeting the \\PIPE\\srvsvc named pipe — the actual vulnerability probe. This error wraps the TCP write failure for that packet, meaning the socket died just before the decisive check.","triggerScenarios":"checkMS17010VulnerabilityAt returns this when conn.Write(transNamedPipe) fails after a successful tree-connect exchange.","commonSituations":"Server or an EDR/IPS closed the connection upon seeing the srvsvc pipe request (common hardening against enumeration); TCP reset mid-session; NAT flow expiry between steps.","solutions":["Retry the full probe on a new connection; the connection is unrecoverable after a failed Write.","Unwrap the cause (EPIPE/ECONNRESET) to confirm peer-side termination and correlate with security software on the target.","Allow-list the scanner IP on the target's host firewall/EDR if you control it and need the check to complete.","If consistently reproducible per host, treat named-pipe access as blocked and mark the MS17-10 result inconclusive."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"conn.SetDeadline(time.Now().Add(5*time.Second))\n// ensure treeID and userID were copied into transNamedPipe before write\nif transNamedPipe[28] == 0 && transNamedPipe[29] == 0 { /* sanity-check treeID present */ }","typeGuard":null,"tryCatchPattern":"if _, err := conn.Write(transNamedPipe); err != nil {\n    conn.Close()\n    return fmt.Errorf(\"named pipe probe write failed: %w\", err) // retry whole probe once\n}","preventionTips":["Retry from a fresh connection; the session dies with the write.","Allow-list the scanner on host firewalls/EDR that block srvsvc pipe requests.","Keep deadlines across the full negotiate→setup→tree→pipe sequence.","Track per-host write failures to identify policy blocks vs. flaky networks."],"tags":["smb","named-pipe","network","ms17-10"],"backgroundTag":"network-request-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}