{"record":{"id":"dd501d6b2a7910dd","repo":"shadow1ng/fscan","slug":"ms17010-smbv1-rejected","errorCode":null,"errorMessage":"ms17010_smbv1_rejected","messagePattern":"ms17010_smbv1_rejected","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"plugins/services/ms17010.go","lineNumber":317,"sourceCode":"\n\tif err = conn.SetDeadline(time.Now().Add(session.Config.ModuleTimeout())); err != nil {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_set_timeout_error\"), err)\n\t}\n\n\t// SMB协议协商\n\tif _, err = conn.Write(negotiateProtocolRequest); err != nil {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_send_protocol_error\"), err)\n\t}\n\n\treply := make([]byte, 1024)\n\tn, readErr := conn.Read(reply)\n\tif readErr != nil || n < 36 {\n\t\t// 连接被关闭或响应不完整，通常表示目标不支持SMBv1\n\t\treturn false, \"\", false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_smbv1_unsupported\"))\n\t}\n\n\tif binary.LittleEndian.Uint32(reply[9:13]) != 0 {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_smbv1_rejected\"))\n\t}\n\n\t// 建立会话\n\tif _, err = conn.Write(sessionSetupRequest); err != nil {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_send_session_error\"), err)\n\t}\n\n\tn, readErr = conn.Read(reply)\n\tif readErr != nil || n < 36 {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_session_failed\"))\n\t}\n\n\tif binary.LittleEndian.Uint32(reply[9:13]) != 0 {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_session_rejected\"))\n\t}\n\n\t// 提取系统信息\n\tvar osVersion string","sourceCodeStart":299,"sourceCodeEnd":335,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L299-L335","documentation":"After the SMBv1 negotiate request, the checker reads the reply and checks the NT status field at bytes 9-12 (little-endian uint32). A non-zero status means the server rejected the protocol negotiation. The library throws this to distinguish 'server answered but refused SMBv1' from a transport failure.","triggerScenarios":"checkMS17010VulnerabilityAt returns this when the negotiate response is at least 36 bytes but binary.LittleEndian.Uint32(reply[9:13]) != 0 (non-success NT status, e.g. STATUS_NOT_IMPLEMENTED or STATUS_LOGON_FAILURE style rejection at protocol level).","commonSituations":"Server accepts the socket but refuses SMBv1 dialect (Samba with server min protocol = SMB2, or Windows with SMB1 auditing/blocking); an SMB-aware IPS/WAF responds with an error packet; load balancer in front of the host answers with a rejection status.","solutions":["Treat a non-zero negotiate status as 'target does not support SMBv1' — MS17-10/EternalBlue cannot be checked, so mark the host not-vulnerable-by-this-check.","Check the server's SMB protocol configuration (`server min protocol` in smb.conf, or Windows SMB1 settings) if you control the target and need the check to run.","Bypass intermediate devices (IPS, SMB proxy) or scan directly against the host to get a genuine negotiate response.","If you expected a vulnerable host, confirm with an independent tool (e.g. `nmap --script smb-vuln-ms17-010`) before trusting a single probe."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// after read: parse NT status before interpreting\nstatus := binary.LittleEndian.Uint32(reply[9:13])\nif status != 0 { // negotiate refused — handle as unsupported }","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"ms17010_smbv1_rejected\") {\n    log.Printf(\"host %s refused SMBv1 negotiate (status!=0); marking inconclusive\", ip)\n    return nil\n}","preventionTips":["Account for Samba/Windows configs that refuse SMBv1 dialects.","Bypass or allow-list IPS devices that answer with error statuses.","Verify protocol support out-of-band before running the MS17-10 check.","Cross-validate with nmap smb-vuln-ms17-010 when a rejection is unexpected."],"tags":["smb","ms17-10","protocol-negotiation","scanning"],"backgroundTag":"smb-request-rejected","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}