shadow1ng/fscan · error

ms17010_send_pipe_error: %w

Error message

ms17010_send_pipe_error: %w

What it means

After the tree connect, the checker writes a Trans request targeting the \PIPE\srvsvc named pipe — the actual vulnerability probe. This error wraps the TCP write failure for that packet, meaning the socket died just before the decisive check.

Source

Thrown at plugins/services/ms17010.go:377

	n, readErr = conn.Read(reply)
	if readErr != nil || n < 36 {
		if readErr != nil {
			return false, osVersion, false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_read_tree_error"), readErr)
		}
		return false, osVersion, false, fmt.Errorf("%s", i18n.GetText("ms17010_tree_response_incomplete"))
	}

	// 命名管道请求
	treeID := reply[28:30]
	transNamedPipe := append([]byte(nil), transNamedPipeRequest...)
	transNamedPipe[28] = treeID[0]
	transNamedPipe[29] = treeID[1]
	transNamedPipe[32] = userID[0]
	transNamedPipe[33] = userID[1]

	if _, err = conn.Write(transNamedPipe); err != nil {
		return false, osVersion, false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_pipe_error"), err)
	}

	n, readErr = conn.Read(reply)
	if readErr != nil || n < 36 {
		if readErr != nil {
			return false, osVersion, false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_read_pipe_error"), readErr)
		}
		return false, osVersion, false, fmt.Errorf("%s", i18n.GetText("ms17010_pipe_response_incomplete"))
	}

	// 漏洞检测 - 关键检查点
	if reply[9] == 0x05 && reply[10] == 0x02 && reply[11] == 0x00 && reply[12] == 0xc0 {
		trans2SessionSetup := append([]byte(nil), trans2SessionSetupRequest...)
		trans2SessionSetup[28] = treeID[0]
		trans2SessionSetup[29] = treeID[1]
		trans2SessionSetup[32] = userID[0]
		trans2SessionSetup[33] = userID[1]

View on GitHub (pinned to 95cc12e753)

Solutions

1. Retry the full probe on a new connection; the connection is unrecoverable after a failed Write.
2. Unwrap the cause (EPIPE/ECONNRESET) to confirm peer-side termination and correlate with security software on the target.
3. Allow-list the scanner IP on the target's host firewall/EDR if you control it and need the check to complete.
4. If consistently reproducible per host, treat named-pipe access as blocked and mark the MS17-10 result inconclusive.

conn.SetDeadline(time.Now().Add(5*time.Second))
// ensure treeID and userID were copied into transNamedPipe before write
if transNamedPipe[28] == 0 && transNamedPipe[29] == 0 { /* sanity-check treeID present */ }

if _, err := conn.Write(transNamedPipe); err != nil {
    conn.Close()
    return fmt.Errorf("named pipe probe write failed: %w", err) // retry whole probe once
}

When it happens

Trigger: checkMS17010VulnerabilityAt returns this when conn.Write(transNamedPipe) fails after a successful tree-connect exchange.

Common situations: Server or an EDR/IPS closed the connection upon seeing the srvsvc pipe request (common hardening against enumeration); TCP reset mid-session; NAT flow expiry between steps.

Related errors

• ms17010_read_pipe_error: %w
• ms17010_smbv1_unsupported
• ms17010_send_session_error: %w
• ms17010_session_failed
• ms17010_send_tree_error: %w

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/ada8cdb6059f0f4a. Report an issue: GitHub.