What causes "MS17-010 exp failed: %w" in shadow1ng/fscan?

Read the wrapped cause after "MS17-010 exp failed:" — fix that specific inner error first.

MS17-010 exp failed: %w

Error message

MS17-010 exp failed: %w

What it means

Generic wrapper for any failure returned by eternalBlue() during the MS17-010 (EternalBlue) exploit run against port 445. The library wraps the inner error (connect, negotiate, groom, send, or size failures) so the operator knows the exploit stage failed. The underlying cause is always in the wrapped error.

Source

Thrown at plugins/services/ms17010.go:473

			sc = fmt.Sprintf("%x", read)
		} else {
			sc = shellcode
		}
	}

	// 验证shellcode有效性
	if len(sc) < 20 {
		return fmt.Errorf("%s", i18n.GetText("ms17010_invalid_shellcode"))
	}

	// 解码shellcode
	scBytes, err := hex.DecodeString(sc)
	if err != nil {
		return fmt.Errorf("%s: %w", i18n.GetText("ms17010_shellcode_decode_failed"), err)
	}

	if err = eternalBlue(net.JoinHostPort(info.Host, "445"), 12, 12, scBytes); err != nil {
		return fmt.Errorf("MS17-010 exp failed: %w", err)
	}

	session.LogSuccess(i18n.Tr("ms17010_shellcode_complete", info.Host, len(scBytes)))
	return nil
}

// init 自动注册插件
func init() {
	// 使用高效注册方式：直接传递端口信息，避免实例创建
	RegisterPluginWithPorts("ms17010", func() Plugin {
		return NewMS17010Plugin()
	}, []int{445})
}

View on GitHub (pinned to 95cc12e753)

Solutions

Read the wrapped cause after "MS17-010 exp failed:" — fix that specific inner error first.
Verify the target actually has SMBv1 exposed on 445 and is a vulnerable Windows version (pre-MS17-010 patch).
Check network path: firewalls, VPN, and IDS/IPS often block EternalBlue's malformed SMB packets.
Confirm port 445 is reachable (`nc -zv host 445`) before running the exploit.
If the inner error is the size error, shorten the shellcode (see error 348).

Defensive patterns

Strategy: try-catch

Validate before calling

conn, err := net.DialTimeout("tcp", net.JoinHostPort(host, "445"), 5*time.Second)
if err != nil {
    return fmt.Errorf("target 445 unreachable, skipping MS17-010: %w", err)
}
conn.Close()

Try / catch

if err := executeMS17010Exploit(info, session); err != nil {
    if errors.Is(err, syscall.ECONNREFUSED) || errors.Is(err, syscall.ETIMEDOUT) {
        return nil // target unreachable; handle as non-vulnerable
    }
    return fmt.Errorf("MS17-010 exploit attempt failed: %w", err)
}

Prevention

Run the vulnerability-check pass first; only exploit hosts confirmed vulnerable.
Verify port 445 reachability and SMBv1 support before invoking the exploit.
Treat all wrapped errors as terminal for that host and move on — do not blind-retry.
Capture the full wrapped error chain in logs for post-scan triage.

When it happens

Trigger: Any inner eternalBlue failure: shellcode exceeding max packet size, TCP connect timeout/refusal to host:445, SMB1 negotiate or anonymous login failure, groom connection failures, failed final Trans2 packet write, or unexpected SMB response — all across up to 12 retry attempts with increasing grooms.

Common situations: Target is patched against MS17-010 or runs a non-Windows/SMBv2-only OS; a firewall or IPS (e.g. an EDR) blocks or resets the crafted SMB traffic; port 445 filtered; target is not Windows (Samba, Linux); network instability mid-exploit.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/c402f471cd95c211. Report an issue: GitHub.