{"record":{"id":"dfd2a4f262157138","repo":"shadow1ng/fscan","slug":"service-auth-failed","errorCode":null,"errorMessage":"service_auth_failed","messagePattern":"service_auth_failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/rdp.go","lineNumber":156,"sourceCode":"\t\t\t}\n\t\t}\n\n\t\t// 记录失败（仅调试时）\n\t\tif err != nil && strings.Contains(err.Error(), \"dial err\") {\n\t\t\t// 端口未开放，直接返回\n\t\t\treturn &ScanResult{\n\t\t\t\tSuccess: false,\n\t\t\t\tService: \"rdp\",\n\t\t\t\tError:   fmt.Errorf(\"%s\", i18n.GetText(\"rdp_port_closed\")),\n\t\t\t}\n\t\t}\n\t}\n\n\t// 所有凭据都失败\n\treturn &ScanResult{\n\t\tSuccess: false,\n\t\tService: \"rdp\",\n\t\tError:   fmt.Errorf(\"%s\", i18n.GetText(\"service_auth_failed\")),\n\t}\n}\n\n// rdpCrack 使用NLA认证验证凭据，不建立完整会话，不会挤掉已登录用户\nfunc (p *RDPPlugin) rdpCrack(host, domain, user, password string, config *common.Config, state *common.State) (bool, error) {\n\ttimeout := int64(config.ModuleTimeout().Seconds())\n\n\t// 使用NLA仅验证模式：只验证凭据，不建立RDP会话\n\t// 这样不会挤掉目标机器上已登录的用户\n\tsuccess, err := login.NlaAuth(host, domain, user, password, timeout)\n\tif success {\n\t\tstate.IncrementTCPSuccessPacketCount()\n\t\treturn true, nil\n\t}\n\n\tif err != nil && strings.Contains(err.Error(), \"dial err\") {\n\t\tstate.IncrementTCPFailedPacketCount()\n\t\treturn false, err","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/rdp.go#L138-L174","documentation":"Guard at the end of RDPPlugin.Scan: every credential pair was tried and none authenticated successfully (no 'dial err' among failures), so the scan concludes with the shared auth-failed sentinel for the RDP service.","triggerScenarios":"Thrown at plugins/services/rdp.go:156 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Expand the credential dictionary","Verify NLA/domain settings match the target environment","Check whether account lockout policy is now blocking logons"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}