What causes "ms17010_read_tree_error: %w" in shadow1ng/fscan?

Increase the socket read deadline and retry once — transient latency is the most common cause.

ms17010_read_tree_error: %w

Error message

ms17010_read_tree_error: %w

What it means

The Tree Connect request was sent but the checker's read of the tree-connect response failed or returned fewer than 36 bytes. Unlike the truncated-error sibling, this variant wraps the underlying read error (%w), preserving the cause (timeout, reset, EOF).

Source

Thrown at plugins/services/ms17010.go:363

				}
			}
		}
	}

	// 树连接请求
	userID := reply[32:34]
	treeConnect := append([]byte(nil), treeConnectRequest...)
	treeConnect[32] = userID[0]
	treeConnect[33] = userID[1]

	if _, err = conn.Write(treeConnect); err != nil {
		return false, osVersion, false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_tree_error"), err)
	}

	n, readErr = conn.Read(reply)
	if readErr != nil || n < 36 {
		if readErr != nil {
			return false, osVersion, false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_read_tree_error"), readErr)
		}
		return false, osVersion, false, fmt.Errorf("%s", i18n.GetText("ms17010_tree_response_incomplete"))
	}

	// 命名管道请求
	treeID := reply[28:30]
	transNamedPipe := append([]byte(nil), transNamedPipeRequest...)
	transNamedPipe[28] = treeID[0]
	transNamedPipe[29] = treeID[1]
	transNamedPipe[32] = userID[0]
	transNamedPipe[33] = userID[1]

	if _, err = conn.Write(transNamedPipe); err != nil {
		return false, osVersion, false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_pipe_error"), err)
	}

	n, readErr = conn.Read(reply)
	if readErr != nil || n < 36 {

View on GitHub (pinned to 95cc12e753)

Solutions

Increase the socket read deadline and retry once — transient latency is the most common cause.
Unwrap the cause: io.EOF/RESET means the peer closed (see tree_response_incomplete path for short-but-clean reads); timeout means raise the deadline or mark inconclusive.
Confirm IPC$ share is reachable with `net use \\host\IPC$` from a Windows client to validate server behavior independently.
Fall back to a non-SMB verification (patch level via WMI with credentials, or vulnerability scanner) when SMB probing keeps failing.

Defensive patterns

Strategy: retry

Validate before calling

conn.SetReadDeadline(time.Now().Add(readTimeout))
n, readErr := conn.Read(reply)
if readErr != nil { /* retry probe; inspect errors.Is(readErr, os.ErrDeadlineExceeded) */ }

Try / catch

n, readErr := conn.Read(reply)
if readErr != nil {
    if errors.Is(readErr, os.ErrDeadlineExceeded) {
        return ErrTimeoutRetry // raise timeout or retry
    }
    return fmt.Errorf("tree connect read failed: %w", readErr)
}

Prevention

Distinguish timeout vs reset via errors.Is on the wrapped cause.
Increase read deadlines for WAN scans.
Validate IPC$ reachability with an independent client before blaming the probe.
Fall back to credentialed or external verification when SMB reads keep failing.

When it happens

Trigger: checkMS17010VulnerabilityAt returns this when conn.Read(reply) after the tree-connect write returns a non-nil readErr (regardless of byte count).

Common situations: Read deadline expired while the server deliberates on the tree connect; server RST the connection due to policy on IPC$; packet loss on WAN links; Samba crashed handling the request.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/7e13ac8e59d5d437. Report an issue: GitHub.