{"record":{"id":"eae81f32e810d5a2","repo":"shadow1ng/fscan","slug":"ms17010-session-rejected","errorCode":null,"errorMessage":"ms17010_session_rejected","messagePattern":"ms17010_session_rejected","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/services/ms17010.go","lineNumber":331,"sourceCode":"\t\treturn false, \"\", false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_smbv1_unsupported\"))\n\t}\n\n\tif binary.LittleEndian.Uint32(reply[9:13]) != 0 {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_smbv1_rejected\"))\n\t}\n\n\t// 建立会话\n\tif _, err = conn.Write(sessionSetupRequest); err != nil {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_send_session_error\"), err)\n\t}\n\n\tn, readErr = conn.Read(reply)\n\tif readErr != nil || n < 36 {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_session_failed\"))\n\t}\n\n\tif binary.LittleEndian.Uint32(reply[9:13]) != 0 {\n\t\treturn false, \"\", false, fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_session_rejected\"))\n\t}\n\n\t// 提取系统信息\n\tvar osVersion string\n\tsessionSetupResponse := reply[36:n]\n\tif len(sessionSetupResponse) > 0 && sessionSetupResponse[0] != 0 && len(sessionSetupResponse) >= 10 {\n\t\tbyteCount := binary.LittleEndian.Uint16(sessionSetupResponse[7:9])\n\t\tif n == int(byteCount)+45 {\n\t\t\tfor i := 10; i < len(sessionSetupResponse)-1; i++ {\n\t\t\t\tif sessionSetupResponse[i] == 0 && sessionSetupResponse[i+1] == 0 {\n\t\t\t\t\tosVersion = string(sessionSetupResponse[10:i])\n\t\t\t\t\tosVersion = strings.ReplaceAll(osVersion, string([]byte{0x00}), \"\")\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n","sourceCodeStart":313,"sourceCodeEnd":349,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L313-L349","documentation":"The session-setup response arrived but carries a non-zero NT status in its header (bytes 9-12), meaning the server refused the anonymous session. The library throws this to signal that the guest/anonymous SMB logon was rejected, which blocks the named-pipe probe used to detect MS17-10.","triggerScenarios":"checkMS17010VulnerabilityAt returns this when the session setup reply is ≥36 bytes but binary.LittleEndian.Uint32(reply[9:13]) != 0 (e.g. STATUS_LOGON_FAILURE, STATUS_ACCESS_DENIED).","commonSituations":"Windows hosts with guest access disabled (`Restrict anonymous` / 'Deny access to this computer from the network' for ANONYMOUS LOGON); Samba with `map to guest = never`; domain controllers that reject anonymous session setup outright; hardening baselines (CIS) that disable null sessions.","solutions":["Enable guest/anonymous session access on the target if it is your host and you need the probe to run (`Set-SmbServerConfiguration -EnableSMB1Protocol $true` plus relax anonymous restrictions) — only in a controlled lab.","Accept the rejection as inconclusive: without a session the pipe check cannot run; fall back to an authenticated probe or an external scanner.","Scan with valid credentials if the library variant supports them, avoiding reliance on anonymous setup.","Check domain/local security policy (secpol: Network access: Let Everyone permissions apply to anonymous users / Restrict anonymous SAM) when you control the host."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// verify anonymous SMB access before probing:\n// cmd: net use \\\\host\\IPC$ \"\" /user:\"\"\n// powershell: Test-NetConnection host -Port 445","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"ms17010_session_rejected\") {\n    log.Printf(\"host %s rejected anonymous SMB session; result inconclusive\", ip)\n    return ErrInconclusive\n}","preventionTips":["Know your targets' anonymous-access policy (Restrict anonymous, map to guest).","Prefer credentialed probing on hardened hosts where null sessions are blocked.","Treat STATUS_LOGON_FAILURE/ACCESS_DENIED on session setup as a policy signal, not a scanner bug.","Run the check from a lab host with identical policy when validating the tool itself."],"tags":["smb","authentication","ms17-10","access-denied"],"backgroundTag":"smb-session-rejected","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}