{"record":{"id":"de80b30c7f57fc7b","repo":"shadow1ng/fscan","slug":"ms17010-send-tree-error-w","errorCode":null,"errorMessage":"ms17010_send_tree_error: %w","messagePattern":"ms17010_send_tree_error: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010.go","lineNumber":357,"sourceCode":"\t\tif n == int(byteCount)+45 {\n\t\t\tfor i := 10; i < len(sessionSetupResponse)-1; i++ {\n\t\t\t\tif sessionSetupResponse[i] == 0 && sessionSetupResponse[i+1] == 0 {\n\t\t\t\t\tosVersion = string(sessionSetupResponse[10:i])\n\t\t\t\t\tosVersion = strings.ReplaceAll(osVersion, string([]byte{0x00}), \"\")\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t// 树连接请求\n\tuserID := reply[32:34]\n\ttreeConnect := append([]byte(nil), treeConnectRequest...)\n\ttreeConnect[32] = userID[0]\n\ttreeConnect[33] = userID[1]\n\n\tif _, err = conn.Write(treeConnect); err != nil {\n\t\treturn false, osVersion, false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_send_tree_error\"), err)\n\t}\n\n\tn, readErr = conn.Read(reply)\n\tif readErr != nil || n < 36 {\n\t\tif readErr != nil {\n\t\t\treturn false, osVersion, false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_read_tree_error\"), readErr)\n\t\t}\n\t\treturn false, osVersion, false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_tree_response_incomplete\"))\n\t}\n\n\t// 命名管道请求\n\ttreeID := reply[28:30]\n\ttransNamedPipe := append([]byte(nil), transNamedPipeRequest...)\n\ttransNamedPipe[28] = treeID[0]\n\ttransNamedPipe[29] = treeID[1]\n\ttransNamedPipe[32] = userID[0]\n\ttransNamedPipe[33] = userID[1]\n","sourceCodeStart":339,"sourceCodeEnd":375,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L339-L375","documentation":"After extracting the UserID from the session-setup response, the checker writes a Tree Connect request (\\\\IP\\IPC$). This error wraps the TCP write failure for that packet, meaning the connection dropped between session setup and tree connect.","triggerScenarios":"checkMS17010VulnerabilityAt returns this when conn.Write(treeConnect) fails after a successful session setup (osVersion may already be populated from the session response).","commonSituations":"Server closed the session right after setup (anonymous session revoked); a security product terminated the flow upon seeing the IPC$ tree connect; transient TCP reset on a lossy network; idle socket reaped by a firewall between packets.","solutions":["Retry the full probe on a fresh connection — the socket is dead once Write fails.","Unwrap the error to check for ECONNRESET/EPIPE to confirm a peer-side close vs. local issue.","Investigate host-based protection (EDR/IPS) that may target IPC$ tree connects from unknown clients.","If this happens consistently against one host, conclude anonymous IPC$ access is blocked and treat the MS17-10 result as inconclusive."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"conn.SetDeadline(time.Now().Add(5*time.Second)) // cover write+read of tree connect\n// ensure session setup succeeded before sending tree connect","typeGuard":null,"tryCatchPattern":"if _, err := conn.Write(treeConnect); err != nil {\n    // reconnect and retry the whole probe once\n    conn.Close()\n    conn, err = net.DialTimeout(\"tcp\", ip+\":445\", dialTimeout)\n}","preventionTips":["Rebuild the connection and restart from negotiate on any write failure.","Watch for EDR/IPS products that kill IPC$ tree connects from unknown sources.","Keep per-step deadlines tight so dead sockets are detected quickly.","Log wrapped causes (errors.Unwrap) to separate peer resets from local errors."],"tags":["smb","tcp","network","ms17-10"],"backgroundTag":"network-request-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}