shadow1ng/fscan · warning

ms17010_session_rejected

Error message

ms17010_session_rejected

What it means

The session-setup response arrived but carries a non-zero NT status in its header (bytes 9-12), meaning the server refused the anonymous session. The library throws this to signal that the guest/anonymous SMB logon was rejected, which blocks the named-pipe probe used to detect MS17-10.

Source

Thrown at plugins/services/ms17010.go:331

		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_smbv1_unsupported"))
	}

	if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_smbv1_rejected"))
	}

	// 建立会话
	if _, err = conn.Write(sessionSetupRequest); err != nil {
		return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_session_error"), err)
	}

	n, readErr = conn.Read(reply)
	if readErr != nil || n < 36 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_session_failed"))
	}

	if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_session_rejected"))
	}

	// 提取系统信息
	var osVersion string
	sessionSetupResponse := reply[36:n]
	if len(sessionSetupResponse) > 0 && sessionSetupResponse[0] != 0 && len(sessionSetupResponse) >= 10 {
		byteCount := binary.LittleEndian.Uint16(sessionSetupResponse[7:9])
		if n == int(byteCount)+45 {
			for i := 10; i < len(sessionSetupResponse)-1; i++ {
				if sessionSetupResponse[i] == 0 && sessionSetupResponse[i+1] == 0 {
					osVersion = string(sessionSetupResponse[10:i])
					osVersion = strings.ReplaceAll(osVersion, string([]byte{0x00}), "")
					break
				}
			}
		}
	}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Enable guest/anonymous session access on the target if it is your host and you need the probe to run (`Set-SmbServerConfiguration -EnableSMB1Protocol $true` plus relax anonymous restrictions) — only in a controlled lab.
2. Accept the rejection as inconclusive: without a session the pipe check cannot run; fall back to an authenticated probe or an external scanner.
3. Scan with valid credentials if the library variant supports them, avoiding reliance on anonymous setup.
4. Check domain/local security policy (secpol: Network access: Let Everyone permissions apply to anonymous users / Restrict anonymous SAM) when you control the host.

// verify anonymous SMB access before probing:
// cmd: net use \\host\IPC$ "" /user:""
// powershell: Test-NetConnection host -Port 445

if err != nil && strings.Contains(err.Error(), "ms17010_session_rejected") {
    log.Printf("host %s rejected anonymous SMB session; result inconclusive", ip)
    return ErrInconclusive
}

When it happens

Trigger: checkMS17010VulnerabilityAt returns this when the session setup reply is ≥36 bytes but binary.LittleEndian.Uint32(reply[9:13]) != 0 (e.g. STATUS_LOGON_FAILURE, STATUS_ACCESS_DENIED).

Common situations: Windows hosts with guest access disabled (`Restrict anonymous` / 'Deny access to this computer from the network' for ANONYMOUS LOGON); Samba with `map to guest = never`; domain controllers that reject anonymous session setup outright; hardening baselines (CIS) that disable null sessions.

Related errors

• ms17010_smbv1_unsupported
• ms17010_smbv1_rejected
• ms17010_send_session_error: %w
• ms17010_session_failed
• ms17010_send_tree_error: %w

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/eae81f32e810d5a2. Report an issue: GitHub.