shadow1ng/fscan · info

ms17010_smbv1_rejected

Error message

ms17010_smbv1_rejected

What it means

After the SMBv1 negotiate request, the checker reads the reply and checks the NT status field at bytes 9-12 (little-endian uint32). A non-zero status means the server rejected the protocol negotiation. The library throws this to distinguish 'server answered but refused SMBv1' from a transport failure.

Source

Thrown at plugins/services/ms17010.go:317

	if err = conn.SetDeadline(time.Now().Add(session.Config.ModuleTimeout())); err != nil {
		return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_set_timeout_error"), err)
	}

	// SMB协议协商
	if _, err = conn.Write(negotiateProtocolRequest); err != nil {
		return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_protocol_error"), err)
	}

	reply := make([]byte, 1024)
	n, readErr := conn.Read(reply)
	if readErr != nil || n < 36 {
		// 连接被关闭或响应不完整，通常表示目标不支持SMBv1
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_smbv1_unsupported"))
	}

	if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_smbv1_rejected"))
	}

	// 建立会话
	if _, err = conn.Write(sessionSetupRequest); err != nil {
		return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_session_error"), err)
	}

	n, readErr = conn.Read(reply)
	if readErr != nil || n < 36 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_session_failed"))
	}

	if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_session_rejected"))
	}

	// 提取系统信息
	var osVersion string

View on GitHub (pinned to 95cc12e753)

Solutions

1. Treat a non-zero negotiate status as 'target does not support SMBv1' — MS17-10/EternalBlue cannot be checked, so mark the host not-vulnerable-by-this-check.
2. Check the server's SMB protocol configuration (`server min protocol` in smb.conf, or Windows SMB1 settings) if you control the target and need the check to run.
3. Bypass intermediate devices (IPS, SMB proxy) or scan directly against the host to get a genuine negotiate response.
4. If you expected a vulnerable host, confirm with an independent tool (e.g. `nmap --script smb-vuln-ms17-010`) before trusting a single probe.

// after read: parse NT status before interpreting
status := binary.LittleEndian.Uint32(reply[9:13])
if status != 0 { // negotiate refused — handle as unsupported }

if err != nil && strings.Contains(err.Error(), "ms17010_smbv1_rejected") {
    log.Printf("host %s refused SMBv1 negotiate (status!=0); marking inconclusive", ip)
    return nil
}

When it happens

Trigger: checkMS17010VulnerabilityAt returns this when the negotiate response is at least 36 bytes but binary.LittleEndian.Uint32(reply[9:13]) != 0 (non-success NT status, e.g. STATUS_NOT_IMPLEMENTED or STATUS_LOGON_FAILURE style rejection at protocol level).

Common situations: Server accepts the socket but refuses SMBv1 dialect (Samba with server min protocol = SMB2, or Windows with SMB1 auditing/blocking); an SMB-aware IPS/WAF responds with an error packet; load balancer in front of the host answers with a rejection status.

Related errors

• ms17010_smbv1_unsupported
• ms17010_send_session_error: %w
• ms17010_session_failed
• ms17010_session_rejected
• ms17010_send_tree_error: %w

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/dd501d6b2a7910dd. Report an issue: GitHub.