{"record":{"id":"eb5a53510b00876b","repo":"shadow1ng/fscan","slug":"read-s","errorCode":null,"errorMessage":"read %s","messagePattern":"read %s","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/tpkt/tpkt.go","lineNumber":124,"sourceCode":"}\n\nfunc (t *TPKT) StartNLA() error {\n\terr := t.StartTLS()\n\tif err != nil {\n\t\tglog.Info(\"start tls failed\", err)\n\t\treturn err\n\t}\n\treq := nla.EncodeDERTRequest([]nla.Message{t.ntlm.GetNegotiateMessage()}, nil, nil)\n\t_, err = t.Conn.Write(req)\n\tif err != nil {\n\t\tglog.Info(\"send NegotiateMessage\", err)\n\t\treturn err\n\t}\n\n\tresp := make([]byte, 1024)\n\tn, err := t.Conn.Read(resp)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read %s\", err)\n\t} else {\n\t\tglog.Debug(\"StartNLA Read success\")\n\t}\n\treturn t.recvChallenge(resp[:n])\n}\n\nfunc (t *TPKT) recvChallenge(data []byte) error {\n\t//own add\n\tglog.Debug(\"start recv challenge......\")\n\tinfo := make(map[string]any)\n\ttype NTLMChallenge struct {\n\t\tSignature              [8]byte\n\t\tMessageType            uint32\n\t\tTargetNameLen          uint16\n\t\tTargetNameMaxLen       uint16\n\t\tTargetNameBufferOffset uint32\n\t\tNegotiateFlags         uint32\n\t\tServerChallenge        uint64","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/tpkt/tpkt.go#L106-L142","documentation":"In the tpkt layer's NLA (CredSSP) flow, StartNLA reads the server's NTLM CHALLENGE response from the socket with a single Conn.Read into a 1024-byte buffer. If the read fails (connection reset, timeout, closed socket), the error is wrapped as 'read %s'. The failed network read means the CredSSP handshake could not continue.","triggerScenarios":"Calling StartNLA and the TCP read of the challenge message fails: server closes the connection abruptly, network interruption mid-handshake, TLS/Negotiate mismatch causing the server to drop the client, or read timeout.","commonSituations":"Servers rejecting credentials and closing the socket during CredSSP; RST from firewalls/IDS mid-handshake; target host rebooting; slow networks exceeding socket deadlines.","solutions":["Inspect the wrapped error: 'connection reset by peer' usually means the server rejected the NEGOTIATE message or credentials.","Verify NLA is enabled and compatible (NTLMv2) on the target host.","Add/retry with a longer socket timeout on the underlying connection.","Retest connectivity (dial + banner) to rule out transient network failure before rerunning StartNLA."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"func nlaProbeSafe(host string) bool {\n\tconn, err := net.DialTimeout(\"tcp\", host, 5*time.Second)\n\tif err != nil { return false }\n\tconn.Close()\n\treturn true\n}","typeGuard":null,"tryCatchPattern":"err := tpktLayer.StartNLA(user, pwd, domain)\nif err != nil && strings.HasPrefix(err.Error(), \"read \") {\n\tif errors.Is(err, io.EOF) || strings.Contains(err.Error(), \"reset\") {\n\t\t// server dropped us mid-CredSSP: check credentials/policy, then retry with backoff\n\t}\n\treturn retryWithBackoff(...)\n}","preventionTips":["Verify dial succeeds and stays open before running StartNLA.","Set adequate socket read deadlines for slow links.","Treat immediate resets as credential/policy rejection, not transient faults.","Avoid probing hosts behind stateful firewalls that RST mid-stream."],"tags":["network","tcp","nla","credssp","read"],"backgroundTag":"network-request-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}