shadow1ng/fscan · error

ms17010_send_session_error: %w

Error message

ms17010_send_session_error: %w

What it means

After a successful negotiate, the checker writes an SMB Session Setup AndX request to the connection. This error wraps the underlying write failure (%w) with the i18n message, meaning the TCP connection broke while sending the session setup packet.

Source

Thrown at plugins/services/ms17010.go:322

	// SMB协议协商
	if _, err = conn.Write(negotiateProtocolRequest); err != nil {
		return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_protocol_error"), err)
	}

	reply := make([]byte, 1024)
	n, readErr := conn.Read(reply)
	if readErr != nil || n < 36 {
		// 连接被关闭或响应不完整，通常表示目标不支持SMBv1
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_smbv1_unsupported"))
	}

	if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_smbv1_rejected"))
	}

	// 建立会话
	if _, err = conn.Write(sessionSetupRequest); err != nil {
		return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_session_error"), err)
	}

	n, readErr = conn.Read(reply)
	if readErr != nil || n < 36 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_session_failed"))
	}

	if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_session_rejected"))
	}

	// 提取系统信息
	var osVersion string
	sessionSetupResponse := reply[36:n]
	if len(sessionSetupResponse) > 0 && sessionSetupResponse[0] != 0 && len(sessionSetupResponse) >= 10 {
		byteCount := binary.LittleEndian.Uint16(sessionSetupResponse[7:9])
		if n == int(byteCount)+45 {
			for i := 10; i < len(sessionSetupResponse)-1; i++ {

View on GitHub (pinned to 95cc12e753)

Solutions

1. Inspect the wrapped error (`errors.Unwrap`) to distinguish RST/broken pipe from timeout; a broken pipe right after negotiate usually means the peer killed the socket.
2. Retry the whole probe from scratch (new TCP connection) — the session is unrecoverable once the write fails.
3. Check for middleboxes idle-killing SMB connections and shorten the gap between negotiate and session setup (the checker does this immediately, so external reset is the likely cause).
4. Confirm the host's 445/tcp service is healthy (no crashed Samba/srv2 process) via the OS event logs.

conn, err := net.DialTimeout("tcp", host+":445", 3*time.Second)
if err != nil { return err }
conn.SetDeadline(time.Now().Add(5*time.Second)) // keep socket alive through all steps

if _, err := conn.Write(sessionSetupRequest); err != nil {
    return fmt.Errorf("ms17010 session setup write failed: %w", err) // inspect via errors.Is(err, syscall.ECONNRESET)
}

When it happens

Trigger: checkMS17010VulnerabilityAt returns this when conn.Write(sessionSetupRequest) returns a non-nil error after a successful negotiate exchange.

Common situations: Peer reset the connection between negotiate and session setup (server crashed on malformed negotiate reply handling); NAT/firewall dropped the flow mid-conversation; connection idle-timeout elapsed between the two packets on a slow link.

Related errors

• ms17010_send_tree_error: %w
• ms17010_connection_error: %w
• ms17010_smbv1_unsupported
• ms17010_session_failed
• ms17010_read_tree_error: %w

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/86e15fe07308c098. Report an issue: GitHub.