What causes "invalid message type 0x%02X in SMB1 response" in shadow1ng/fscan?

Verify the target address/port actually hosts an SMB service speaking NetBIOS framing

invalid message type 0x%02X in SMB1 response

Error message

invalid message type 0x%02X in SMB1 response

What it means

This error is returned by smb1GetResponse when the first byte of the NetBIOS session header is not 0x00 (the Session Message type) (plugins/services/ms17010_exp.go:196). NetBIOS session service uses 0x00 for session messages; other type bytes (e.g. 0x81 session request, 0x82/0x83 session keepalive/retarget, 0x85 session end) indicate the peer is not speaking the expected SMB-over-NetBIOS framing. The library throws it to fail fast on non-SMB or out-of-sync responses.

Source

Thrown at plugins/services/ms17010_exp.go:196

	Reserved2       [2]byte
	TreeID          uint16
	ProcessID       uint16
	UserID          uint16
	MultiplexID     uint16
}

func smb1GetResponse(conn net.Conn) ([]byte, *smbHeader, error) {
	// net BIOS
	buf := make([]byte, 4)
	_, err := io.ReadFull(conn, buf)
	if err != nil {
		const format = "failed to get SMB1 response about NetBIOS session service: %s"
		return nil, nil, fmt.Errorf(format, err)
	}
	typ := buf[0]
	if typ != 0x00 {
		const format = "invalid message type 0x%02X in SMB1 response"
		return nil, nil, fmt.Errorf(format, typ)
	}
	sizeBuf := make([]byte, 4)
	copy(sizeBuf[1:], buf[1:])
	size := int(binary.BigEndian.Uint32(sizeBuf))
	// 畸形响应（size < SMB 头长度）会导致后续 buf[:smbHeaderSize] 越界 panic
	if size < smbHeaderSize {
		return nil, nil, fmt.Errorf("SMB1 response too short: %d bytes", size)
	}
	// SMB
	buf = make([]byte, size)
	_, err = io.ReadFull(conn, buf)
	if err != nil {
		const format = "failed to get SMB1 response about header: %s"
		return nil, nil, fmt.Errorf(format, err)
	}
	smbHeader := smbHeader{}
	reader := bytes.NewReader(buf[:smbHeaderSize])
	err = binary.Read(reader, binary.LittleEndian, &smbHeader)

View on GitHub (pinned to 95cc12e753)

Solutions

Verify the target address/port actually hosts an SMB service speaking NetBIOS framing
Look at the printed type byte: 0x8x values are NetBIOS control messages (negative session response = server refusing), indicating the server rejected the session
Re-establish a fresh connection; a desynchronized stream cannot recover mid-session
If scanning port 139, ensure the NetBIOS session request handshake is performed before SMB negotiation

Example fix

// before
typ := buf[0]
if typ != 0x00 {
    return nil, nil, fmt.Errorf("invalid message type 0x%02X in SMB1 response", typ)
}
// after
typ := buf[0]
if typ != 0x00 {
    return nil, nil, fmt.Errorf("invalid message type 0x%02X in SMB1 response (expected 0x00 session message; 0x8x = NetBIOS control)", typ)
}

Defensive patterns

Strategy: validation

Validate before calling

// Pre-check that the endpoint answers SMB-style NetBIOS framing
func looksLikeSMB(address string) bool {
    conn, err := net.DialTimeout("tcp", address, 5*time.Second)
    if err != nil { return false }
    defer conn.Close()
    _ = conn.SetReadDeadline(time.Now().Add(5 * time.Second))
    if err := smbClientNegotiate(conn); err != nil {
        return !strings.Contains(err.Error(), "invalid message type")
    }
    return true
}

Try / catch

_, _, err := smb1GetResponse(conn)
if err != nil {
    var bad byte
    if n, _ := fmt.Sscanf(err.Error(), "invalid message type 0x%02X in SMB1 response", &bad); n == 1 && bad&0x80 != 0 {
        // NetBIOS control (e.g. negative session response): server refused the session
        return classifyHost("netbios-refused")
    }
    return classifyHost("not-smb")
}

Prevention

Confirm the port hosts SMB before connecting (445 directly; 139 needs a NetBIOS session request first)
Treat 0x8x type bytes as meaningful: 0x82/0x83 = negative session response from the server
Never continue reading on a desynchronized stream — reconnect instead
Honeypots often reply with junk frames; flag and skip such hosts

When it happens

Trigger: Any smb1GetResponse caller receives 4 bytes whose first byte differs from 0x00 — e.g. connecting to a port that is not SMB/NetBIOS, a proxy answering with a different protocol, or the stream desynchronized so a payload byte is read as the type byte.

Common situations: Pointing the scanner at the wrong port (139 vs 445 confusion, or a non-SMB service); MITM proxies/honeypots replying with NetBIOS session-request negatives (0x82/0x83); prior malformed response leaving extra bytes in the stream.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/21fb17bd3d1816ca. Report an issue: GitHub.