shadow1ng/fscan · error

ms17010_session_failed

Error message

ms17010_session_failed

What it means

The checker sent the Session Setup request and then reads the response; this error fires when the read fails or returns fewer than the 36-byte SMB header minimum. It means no complete session-setup reply arrived, so the anonymous session could not be established.

Source

Thrown at plugins/services/ms17010.go:327

	reply := make([]byte, 1024)
	n, readErr := conn.Read(reply)
	if readErr != nil || n < 36 {
		// 连接被关闭或响应不完整，通常表示目标不支持SMBv1
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_smbv1_unsupported"))
	}

	if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_smbv1_rejected"))
	}

	// 建立会话
	if _, err = conn.Write(sessionSetupRequest); err != nil {
		return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_session_error"), err)
	}

	n, readErr = conn.Read(reply)
	if readErr != nil || n < 36 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_session_failed"))
	}

	if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_session_rejected"))
	}

	// 提取系统信息
	var osVersion string
	sessionSetupResponse := reply[36:n]
	if len(sessionSetupResponse) > 0 && sessionSetupResponse[0] != 0 && len(sessionSetupResponse) >= 10 {
		byteCount := binary.LittleEndian.Uint16(sessionSetupResponse[7:9])
		if n == int(byteCount)+45 {
			for i := 10; i < len(sessionSetupResponse)-1; i++ {
				if sessionSetupResponse[i] == 0 && sessionSetupResponse[i+1] == 0 {
					osVersion = string(sessionSetupResponse[10:i])
					osVersion = strings.ReplaceAll(osVersion, string([]byte{0x00}), "")
					break
				}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Retry the probe with a longer socket deadline — the first read after write is the most timeout-sensitive step.
2. Treat repeated truncation as an indication the host blocks anonymous SMB sessions; MS17-10 probing requires session setup, so mark the result inconclusive.
3. Verify no IDS/IPS is resetting or truncating SMB flows to port 445.
4. Check the target service is alive and responding (previous negotiate step succeeded, so a sudden drop points at session-policy or network reset, not host death).

conn.SetReadDeadline(time.Now().Add(readTimeout)) // generous deadline before the session-setup read
if n, err := conn.Read(buf); err != nil || n < 36 { /* handle short/failed read before proceeding */ }

n, readErr := conn.Read(reply)
if readErr != nil || n < 36 {
    return fmt.Errorf("ms17010 session setup response incomplete: %w", readErr) // retry whole probe once
}

When it happens

Trigger: checkMS17010VulnerabilityAt returns this when conn.Read(reply) after writing sessionSetupRequest errors out or yields n < 36 bytes.

Common situations: Server closes the socket on receiving the session setup (strict anonymous-access policy); the read times out on a slow/wide-area link; a TCP middlebox truncates the flow; the target's SMB stack accepted negotiate but rejects the anonymous session silently by dropping.

Related errors

• ms17010_read_tree_error: %w
• ms17010_smbv1_unsupported
• ms17010_send_session_error: %w
• ms17010_send_tree_error: %w
• ms17010_tree_response_incomplete

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/2f556e631943ccb4. Report an issue: GitHub.