shadow1ng/fscan · error

ms17010_send_tree_error: %w

Error message

ms17010_send_tree_error: %w

What it means

After extracting the UserID from the session-setup response, the checker writes a Tree Connect request (\\IP\IPC$). This error wraps the TCP write failure for that packet, meaning the connection dropped between session setup and tree connect.

Source

Thrown at plugins/services/ms17010.go:357

		if n == int(byteCount)+45 {
			for i := 10; i < len(sessionSetupResponse)-1; i++ {
				if sessionSetupResponse[i] == 0 && sessionSetupResponse[i+1] == 0 {
					osVersion = string(sessionSetupResponse[10:i])
					osVersion = strings.ReplaceAll(osVersion, string([]byte{0x00}), "")
					break
				}
			}
		}
	}

	// 树连接请求
	userID := reply[32:34]
	treeConnect := append([]byte(nil), treeConnectRequest...)
	treeConnect[32] = userID[0]
	treeConnect[33] = userID[1]

	if _, err = conn.Write(treeConnect); err != nil {
		return false, osVersion, false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_tree_error"), err)
	}

	n, readErr = conn.Read(reply)
	if readErr != nil || n < 36 {
		if readErr != nil {
			return false, osVersion, false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_read_tree_error"), readErr)
		}
		return false, osVersion, false, fmt.Errorf("%s", i18n.GetText("ms17010_tree_response_incomplete"))
	}

	// 命名管道请求
	treeID := reply[28:30]
	transNamedPipe := append([]byte(nil), transNamedPipeRequest...)
	transNamedPipe[28] = treeID[0]
	transNamedPipe[29] = treeID[1]
	transNamedPipe[32] = userID[0]
	transNamedPipe[33] = userID[1]

View on GitHub (pinned to 95cc12e753)

Solutions

1. Retry the full probe on a fresh connection — the socket is dead once Write fails.
2. Unwrap the error to check for ECONNRESET/EPIPE to confirm a peer-side close vs. local issue.
3. Investigate host-based protection (EDR/IPS) that may target IPC$ tree connects from unknown clients.
4. If this happens consistently against one host, conclude anonymous IPC$ access is blocked and treat the MS17-10 result as inconclusive.

conn.SetDeadline(time.Now().Add(5*time.Second)) // cover write+read of tree connect
// ensure session setup succeeded before sending tree connect

if _, err := conn.Write(treeConnect); err != nil {
    // reconnect and retry the whole probe once
    conn.Close()
    conn, err = net.DialTimeout("tcp", ip+":445", dialTimeout)
}

When it happens

Trigger: checkMS17010VulnerabilityAt returns this when conn.Write(treeConnect) fails after a successful session setup (osVersion may already be populated from the session response).

Common situations: Server closed the session right after setup (anonymous session revoked); a security product terminated the flow upon seeing the IPC$ tree connect; transient TCP reset on a lossy network; idle socket reaped by a firewall between packets.

Related errors

• ms17010_send_session_error: %w
• ms17010_connection_error: %w
• ms17010_smbv1_unsupported
• ms17010_session_failed
• ms17010_read_tree_error: %w

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/de80b30c7f57fc7b. Report an issue: GitHub.