What causes "failed to login with anonymous: %s" in shadow1ng/fscan?

Read the wrapped smb1GetResponse/write error to determine if the peer reset vs timed out

failed to login with anonymous: %s

Error message

failed to login with anonymous: %s

What it means

This error wraps a failure of smb1AnonymousLogin (Session Setup AndX with an empty/anonymous credential) inside smb1AnonymousConnectIPC (plugins/services/ms17010_exp.go:151). smb1AnonymousLogin writes a fixed SMB1 session-setup packet and reads the reply through smb1GetResponse, so failures here are transport-level (write error, malformed/absent response), not credential rejections. The library throws it because the anonymous session must be set up before the OS-name read and IPC tree connect.

Source

Thrown at plugins/services/ms17010_exp.go:151

func smb1AnonymousConnectIPC(address string) (*smbHeader, net.Conn, error) {
	conn, err := net.DialTimeout("tcp", address, 10*time.Second)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to connect host: %s", err)
	}
	var ok bool
	defer func() {
		if !ok {
			_ = conn.Close()
		}
	}()
	err = smbClientNegotiate(conn)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to negotiate: %s", err)
	}
	raw, header, err := smb1AnonymousLogin(conn)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to login with anonymous: %s", err)
	}
	_, err = getOSName(raw)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to get OS name: %s", err)
	}
	//fmt.Println("OS:", osName)
	header, err = treeConnectAndX(conn, address, header.UserID)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to tree connect AndX: %s", err)
	}
	ok = true
	return header, conn, nil
}

const smbHeaderSize = 32

type smbHeader struct {
	ServerComponent [4]byte

View on GitHub (pinned to 95cc12e753)

Solutions

Read the wrapped smb1GetResponse/write error to determine if the peer reset vs timed out
Verify the target accepts anonymous (null-session) SMB1 logins; modern/patched servers commonly reject them
Ensure SMB1 is enabled on the target — the login packet is SMB1-only
Retry the host; transient connection drops during scans frequently produce this

Defensive patterns

Strategy: retry

Validate before calling

// A host that passed negotiate is usually OK; retry transient login drops
for i := 0; i < 3; i++ {
    h, c, err := smb1AnonymousConnectIPC(addr)
    if err == nil { _ = c.Close(); return true }
    if !strings.Contains(err.Error(), "failed to login with anonymous") { return false }
    time.Sleep(time.Second)
}
return false

Try / catch

if err != nil {
    if strings.Contains(err.Error(), "failed to login with anonymous") &&
        isNetworkWrapped(err) { // write/read error, not policy rejection
        retry()
    } else {
        markHostUnsupported()
    }
}

Prevention

Expect null-session rejections on hardened hosts; treat persistent failure as 'anonymous logins disabled'
Ensure SMB1 is enabled — SMB2-only servers break this fixed SMB1 login packet
Retry with a new connection; the old session is dead after any mid-frame failure
Log the inner error to tell resets (retryable) from clean rejections (not retryable)

When it happens

Trigger: The conn.Write of the Session Setup AndX packet fails, or smb1GetResponse fails on the reply: NetBIOS header read error/timeout, invalid message type byte, response shorter than 32 bytes, incomplete body, or unparseable SMB header.

Common situations: Target aborts the session when it sees the anonymous/NTLM-less login (hardened or SMB2-only servers); a middlebox resets the flow; the server crashed or dropped the socket after negotiate; scanning a non-Windows SMB implementation that rejects the hardcoded packet layout.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/0e0e67d0ccccc6e2. Report an issue: GitHub.