shadow1ng/fscan · info

ms17010_smbv1_unsupported

Error message

ms17010_smbv1_unsupported

What it means

The MS17-10 checker opens a TCP connection to port 445 and sends an SMBv1 negotiate request. This error means the connection was closed by the peer or the SMB response header was shorter than the 36-byte minimum, so the target does not speak SMBv1. The library throws it to report 'not vulnerable / cannot test' for legacy-protocol-disabled hosts, not an internal failure.

Source

Thrown at plugins/services/ms17010.go:313

	if err != nil {
		return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_connection_error"), err)
	}
	defer func() { _ = conn.Close() }()

	if err = conn.SetDeadline(time.Now().Add(session.Config.ModuleTimeout())); err != nil {
		return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_set_timeout_error"), err)
	}

	// SMB协议协商
	if _, err = conn.Write(negotiateProtocolRequest); err != nil {
		return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_protocol_error"), err)
	}

	reply := make([]byte, 1024)
	n, readErr := conn.Read(reply)
	if readErr != nil || n < 36 {
		// 连接被关闭或响应不完整，通常表示目标不支持SMBv1
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_smbv1_unsupported"))
	}

	if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_smbv1_rejected"))
	}

	// 建立会话
	if _, err = conn.Write(sessionSetupRequest); err != nil {
		return false, "", false, fmt.Errorf("%s: %w", i18n.GetText("ms17010_send_session_error"), err)
	}

	n, readErr = conn.Read(reply)
	if readErr != nil || n < 36 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_session_failed"))
	}

	if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
		return false, "", false, fmt.Errorf("%s", i18n.GetText("ms17010_session_rejected"))

View on GitHub (pinned to 95cc12e753)

Solutions

1. Verify the target actually has SMBv1 enabled (Check with `Get-SmbServerConfiguration | Select EnableSMB1Protocol` on Windows); patch MS17-10 out-of-band if SMBv1 is off since EternalBlue requires SMBv1.
2. Confirm port 445 is reachable end-to-end (no stateful firewall/NAT RST); test with `nmap -p445 --script smb-protocols <host>`.
3. If scanning a modern Windows host, expect this error as a benign 'not exploitable via EternalBlue' outcome and treat it as non-vulnerable rather than retrying.
4. Retry once with a longer timeout if the network is lossy; a torn read under 36 bytes can look identical to a refused protocol.

conn, err := net.DialTimeout("tcp", host+":445", 3*time.Second)
if err != nil { return err }
conn.SetDeadline(time.Now().Add(5*time.Second))
// optionally pre-check protocol support: nmap -p445 --script smb-protocols host

vulnerable, os, extra, err := checkMS17010VulnerabilityAt(conn, ip)
if err != nil {
    if strings.Contains(err.Error(), "ms17010_smbv1_unsupported") {
        // treat as not vulnerable via SMBv1; log and continue
        return false
    }
    return err
}

When it happens

Trigger: checkMS17010VulnerabilityAt returns this when conn.Read after sending the SMB negotiate request fails, or returns fewer than 36 bytes (the minimum NetBIOS+SMB header size).

Common situations: Target runs SMB2+ only (Windows 10 1709+, Server 2019 with SMB1 removed); a firewall sends TCP RST or silently drops after connect; a honeypot/middleware accepts the socket but closes it; the host is a non-Windows device with port 445 open (e.g. Samba with min protocol SMB2).

Related errors

• ms17010_smbv1_rejected
• ms17010_send_session_error: %w
• ms17010_session_failed
• ms17010_send_tree_error: %w
• ms17010_read_tree_error: %w

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/5b5bfb46bb7abccd. Report an issue: GitHub.