{"record":{"id":"c402f471cd95c211","repo":"shadow1ng/fscan","slug":"ms17-010-exp-failed-w","errorCode":null,"errorMessage":"MS17-010 exp failed: %w","messagePattern":"MS17-010 exp failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010.go","lineNumber":473,"sourceCode":"\t\t\tsc = fmt.Sprintf(\"%x\", read)\n\t\t} else {\n\t\t\tsc = shellcode\n\t\t}\n\t}\n\n\t// 验证shellcode有效性\n\tif len(sc) < 20 {\n\t\treturn fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_invalid_shellcode\"))\n\t}\n\n\t// 解码shellcode\n\tscBytes, err := hex.DecodeString(sc)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_shellcode_decode_failed\"), err)\n\t}\n\n\tif err = eternalBlue(net.JoinHostPort(info.Host, \"445\"), 12, 12, scBytes); err != nil {\n\t\treturn fmt.Errorf(\"MS17-010 exp failed: %w\", err)\n\t}\n\n\tsession.LogSuccess(i18n.Tr(\"ms17010_shellcode_complete\", info.Host, len(scBytes)))\n\treturn nil\n}\n\n// init 自动注册插件\nfunc init() {\n\t// 使用高效注册方式：直接传递端口信息，避免实例创建\n\tRegisterPluginWithPorts(\"ms17010\", func() Plugin {\n\t\treturn NewMS17010Plugin()\n\t}, []int{445})\n}\n","sourceCodeStart":455,"sourceCodeEnd":487,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L455-L487","documentation":"Generic wrapper for any failure returned by eternalBlue() during the MS17-010 (EternalBlue) exploit run against port 445. The library wraps the inner error (connect, negotiate, groom, send, or size failures) so the operator knows the exploit stage failed. The underlying cause is always in the wrapped error.","triggerScenarios":"Any inner eternalBlue failure: shellcode exceeding max packet size, TCP connect timeout/refusal to host:445, SMB1 negotiate or anonymous login failure, groom connection failures, failed final Trans2 packet write, or unexpected SMB response — all across up to 12 retry attempts with increasing grooms.","commonSituations":"Target is patched against MS17-010 or runs a non-Windows/SMBv2-only OS; a firewall or IPS (e.g. an EDR) blocks or resets the crafted SMB traffic; port 445 filtered; target is not Windows (Samba, Linux); network instability mid-exploit.","solutions":["Read the wrapped cause after \"MS17-010 exp failed:\" — fix that specific inner error first.","Verify the target actually has SMBv1 exposed on 445 and is a vulnerable Windows version (pre-MS17-010 patch).","Check network path: firewalls, VPN, and IDS/IPS often block EternalBlue's malformed SMB packets.","Confirm port 445 is reachable (`nc -zv host 445`) before running the exploit.","If the inner error is the size error, shorten the shellcode (see error 348)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"conn, err := net.DialTimeout(\"tcp\", net.JoinHostPort(host, \"445\"), 5*time.Second)\nif err != nil {\n    return fmt.Errorf(\"target 445 unreachable, skipping MS17-010: %w\", err)\n}\nconn.Close()","typeGuard":null,"tryCatchPattern":"if err := executeMS17010Exploit(info, session); err != nil {\n    if errors.Is(err, syscall.ECONNREFUSED) || errors.Is(err, syscall.ETIMEDOUT) {\n        return nil // target unreachable; handle as non-vulnerable\n    }\n    return fmt.Errorf(\"MS17-010 exploit attempt failed: %w\", err)\n}","preventionTips":["Run the vulnerability-check pass first; only exploit hosts confirmed vulnerable.","Verify port 445 reachability and SMBv1 support before invoking the exploit.","Treat all wrapped errors as terminal for that host and move on — do not blind-retry.","Capture the full wrapped error chain in logs for post-scan triage."],"tags":["go","network","smb","exploit","ms17010"],"backgroundTag":"exploit-execution-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}