What causes "failed to send smb1 free hole session packet: %s" in shadow1ng/fscan?

Check for IPS/RST behavior between scanner and target

failed to send smb1 free hole session packet: %s

Error message

failed to send smb1 free hole session packet: %s

What it means

smb1FreeHole builds a free-hole session packet with makeSMB1FreeHoleSessionPacket and writes it to the connection. A conn.Write failure is wrapped as 'failed to send smb1 free hole session packet'. This is a TCP write failure deep in the exploit's spray setup.

Source

Thrown at plugins/services/ms17010_exp.go:824

	var (
		flags2   []byte
		vcNum    []byte
		nativeOS []byte
	)
	if start {
		flags2 = []byte{0x07, 0xC0}
		vcNum = []byte{0x2D, 0x01}
		nativeOS = []byte{0xF0, 0xFF, 0x00, 0x00, 0x00}
	} else {
		flags2 = []byte{0x07, 0x40}
		vcNum = []byte{0x2C, 0x01}
		nativeOS = []byte{0xF8, 0x87, 0x00, 0x00, 0x00}
	}
	packet := makeSMB1FreeHoleSessionPacket(flags2, vcNum, nativeOS)
	_, err = conn.Write(packet)
	if err != nil {
		const format = "failed to send smb1 free hole session packet: %s"
		return nil, fmt.Errorf(format, err)
	}
	_, _, err = smb1GetResponse(conn)
	if err != nil {
		return nil, err
	}
	ok = true
	return conn, nil
}

func makeSMB1FreeHoleSessionPacket(flags2, vcNum, nativeOS []byte) []byte {
	buf := bytes.Buffer{}

	// --------NetBIOS Session Service--------

	// message type
	buf.WriteByte(0x00)
	// length
	buf.Write([]byte{0x00, 0x00, 0x51})

View on GitHub (pinned to 95cc12e753)

Solutions

Check for IPS/RST behavior between scanner and target
Verify SMB1 support on the target host
Retry the exploit; connection resets mid-write are often transient
Add a write deadline and log the underlying errno for diagnosis

Defensive patterns

Strategy: retry

Validate before calling

// ensure a fresh, confirmed-alive connection before the hole session packet
if tc, ok := conn.(*net.TCPConn); ok {
    _ = tc.SetWriteDeadline(time.Now().Add(10 * time.Second))
}

Try / catch

conn, err := smb1FreeHole(address, true)
if err != nil {
    if errors.Is(err, syscall.EPIPE) || errors.Is(err, syscall.ECONNRESET) {
        // reconnect and retry the free-hole setup
    }
    return err
}

Prevention

Retry the whole smb1FreeHole sequence on write failure; sockets mid-handshake are fragile
Keep inter-packet delays small so the target does not reap idle sockets
Watch for IDS resets when packets match exploit signatures
Log the errno of failed writes for diagnosis

When it happens

Trigger: exploit → smb1FreeHole → conn.Write(packet) fails because the peer reset the connection after negotiate, the socket timed out, or an inline device dropped the packet.

Common situations: Target or IPS closing the connection once it sees exploit-pattern packets; unreliable links; stale sockets after long-running scans.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/c67e5acd27210b44. Report an issue: GitHub.