shadow1ng/fscan · error

failed to connect host: %s

Error message

failed to connect host: %s

What it means

This error is returned by smb1AnonymousConnectIPC when the initial TCP dial to the target (net.DialTimeout on the address:port, 10s timeout) fails (plugins/services/ms17010_exp.go:137). The library throws it because the SMB1 anonymous IPC session cannot even be established at the transport layer. The wrapped net.OpError tells you whether it was refused, timed out, or was unreachable.

Source

Thrown at plugins/services/ms17010_exp.go:137

	return nil
}

func makeKernelUserPayload(sc []byte) []byte {
	// test DoublePulsar
	buf := bytes.Buffer{}
	buf.Write(loader[:])
	// write sc size
	size := make([]byte, 2)
	binary.LittleEndian.PutUint16(size, uint16(len(sc)))
	buf.Write(size)
	buf.Write(sc)
	return buf.Bytes()
}

func smb1AnonymousConnectIPC(address string) (*smbHeader, net.Conn, error) {
	conn, err := net.DialTimeout("tcp", address, 10*time.Second)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to connect host: %s", err)
	}
	var ok bool
	defer func() {
		if !ok {
			_ = conn.Close()
		}
	}()
	err = smbClientNegotiate(conn)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to negotiate: %s", err)
	}
	raw, header, err := smb1AnonymousLogin(conn)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to login with anonymous: %s", err)
	}
	_, err = getOSName(raw)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to get OS name: %s", err)

View on GitHub (pinned to 95cc12e753)

Solutions

1. Verify the address includes the correct port (host:port, e.g. 192.168.1.10:445) and resolves
2. Probe the port first (nc -zv host 445) to confirm reachability before running the exploit
3. Check firewall/ACL on the target and any intermediate network allows TCP to the SMB port
4. Increase tolerance for slow hosts: the dial uses a fixed 10s timeout; retry hosts that time out intermittently

Example fix

// before
conn, err := net.DialTimeout("tcp", address, 10*time.Second)
if err != nil {
    return nil, nil, fmt.Errorf("failed to connect host: %s", err)
}
// after
if _, _, err := net.SplitHostPort(address); err != nil {
    address = net.JoinHostPort(address, "445") // default SMB port
}
conn, err := net.DialTimeout("tcp", address, 10*time.Second)
if err != nil {
    return nil, nil, fmt.Errorf("failed to connect host %s: %w", address, err)
}

// Validate reachability before calling the exploit
func requireSMBPort(address string) error {
    _, port, err := net.SplitHostPort(address)
    if err != nil { return fmt.Errorf("address must be host:port: %w", err) }
    conn, err := net.DialTimeout("tcp", address, 5*time.Second)
    if err != nil { return err }
    _ = conn.Close()
    _ = port
    return nil
}

func validHostPort(s string) bool {
    host, port, err := net.SplitHostPort(s)
    if err != nil || host == "" { return false }
    p, err := strconv.Atoi(port)
    return err == nil && p > 0 && p < 65536
}

header, conn, err := smb1AnonymousConnectIPC(addr)
if err != nil && strings.Contains(err.Error(), "failed to connect host") {
    log.Printf("unreachable %s: %v", addr, err)
    return // skip host, do not retry in-process
}

When it happens

Trigger: Calling exploit()/smb1AnonymousConnectIPC with an address where nothing listens on the port (connection refused), the host is down or unroutable (i/o timeout / no route to host), or DNS name does not resolve.

Common situations: Scanning hosts that have SMB (445) firewalled off; wrong port passed in the address string; target VM powered off; scanning across a VPN where the subnet is unreachable; IPv6 literal without brackets in host:port form.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

• ms17010_connection_error: %w
• service_connection_failed
• [dial err] %v
• socks5_target_connect_failed: %w
• i18n.Tr("service_connection_failed", "%w")

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/f415d5aab4b2260c. Report an issue: GitHub.