shadow1ng/fscan · error

failed to get SMB1 response about NetBIOS session service: %

Error message

failed to get SMB1 response about NetBIOS session service: %s

What it means

This error is returned by smb1GetResponse when reading the 4-byte NetBIOS session-service header from the connection fails (plugins/services/ms17010_exp.go:191). It uses io.ReadFull, so any short read, connection close, or deadline expiry before 4 bytes arrive is wrapped here. The library throws it because no SMB frame can be interpreted without the NetBIOS length header.

Source

Thrown at plugins/services/ms17010_exp.go:191

	ErrorCode       uint16
	Flags           uint8
	Flags2          uint16
	ProcessIDHigh   uint16
	Signature       [8]byte
	Reserved2       [2]byte
	TreeID          uint16
	ProcessID       uint16
	UserID          uint16
	MultiplexID     uint16
}

func smb1GetResponse(conn net.Conn) ([]byte, *smbHeader, error) {
	// net BIOS
	buf := make([]byte, 4)
	_, err := io.ReadFull(conn, buf)
	if err != nil {
		const format = "failed to get SMB1 response about NetBIOS session service: %s"
		return nil, nil, fmt.Errorf(format, err)
	}
	typ := buf[0]
	if typ != 0x00 {
		const format = "invalid message type 0x%02X in SMB1 response"
		return nil, nil, fmt.Errorf(format, typ)
	}
	sizeBuf := make([]byte, 4)
	copy(sizeBuf[1:], buf[1:])
	size := int(binary.BigEndian.Uint32(sizeBuf))
	// 畸形响应（size < SMB 头长度）会导致后续 buf[:smbHeaderSize] 越界 panic
	if size < smbHeaderSize {
		return nil, nil, fmt.Errorf("SMB1 response too short: %d bytes", size)
	}
	// SMB
	buf = make([]byte, size)
	_, err = io.ReadFull(conn, buf)
	if err != nil {
		const format = "failed to get SMB1 response about header: %s"

View on GitHub (pinned to 95cc12e753)

Solutions

1. Check the wrapped error: io.EOF/RESET means the peer closed — likely non-vulnerable or rate-limiting; os.ErrDeadlineExceeded means slow/no response
2. Retry the operation; transient drops are common in scanning
3. Verify SMB1 connectivity with a simple negotiate/echo probe before running heavier stages
4. Extend the read deadline for slow targets if you control the calling code

Example fix

// before
_, err := io.ReadFull(conn, buf)
if err != nil {
    return nil, nil, fmt.Errorf("failed to get SMB1 response about NetBIOS session service: %s", err)
}
// after
_, err := io.ReadFull(conn, buf)
if err != nil {
    if errors.Is(err, os.ErrDeadlineExceeded) {
        return nil, nil, fmt.Errorf("target did not answer within deadline (NetBIOS header): %w", err)
    }
    return nil, nil, fmt.Errorf("failed to get SMB1 response about NetBIOS session service: %w", err)
}

// Confirm a full SMB1 round trip works before heavier stages
func probeSMB1(address string) error {
    conn, err := net.DialTimeout("tcp", address, 10*time.Second)
    if err != nil { return err }
    defer conn.Close()
    _ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))
    if err := smbClientNegotiate(conn); err != nil { return err }
    return nil
}

func isPeerClosedOrTimeout(err error) bool {
    return errors.Is(err, io.EOF) ||
        errors.Is(err, io.ErrUnexpectedEOF) ||
        errors.Is(err, os.ErrDeadlineExceeded) ||
        errors.Is(err, syscall.ECONNRESET)
}

raw, header, err := smb1GetResponse(conn)
if err != nil {
    if isPeerClosedOrTimeout(err) {
        return retryWithFreshConnection() // peer dropped us; retry elsewhere
    }
    return err
}

When it happens

Trigger: Any caller of smb1GetResponse (exploit, smbClientNegotiate, smb1AnonymousLogin, treeConnectAndX, smb1LargeBuffer, sendNTTrans, smb1FreeHole) whose peer closes/resets the TCP connection before sending a reply, or whose read deadline (10s via SetReadDeadline) expires with no data.

Common situations: Patched hosts that kill the connection upon receiving EternalBlue probe/exploit packets; target overloaded and not answering within the 10s deadline; firewall silently dropping the established session; server closed socket after previous malformed request.

Related errors

• failed to get SMB1 response about header: %s
• netbios_smb_negotiate_send_failed: %w
• netbios_smb_negotiate_read_failed: %w
• netbios_smb_session_send_failed: %w
• netbios_smb_session_read_failed: %w

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/3cea732cac74a548. Report an issue: GitHub.