shadow1ng/fscan · error

NLA auth timeout

Error message

NLA auth timeout

What it means

NlaAuthOnly waits on resultChan with a deadline of timeout*3 seconds. If neither the success sentinel (tpkt.ErrNLAAuthSuccess) nor an error arrives before the deadline, it gives up with 'NLA auth timeout'. This guards against servers that accept the TCP connection but stall during CredSSP/NTLMv2 negotiation.

Source

Thrown at libs/grdp/login/screen.go:170

	g.x224.On("connect", func(protocol uint32) {
		resultChan <- fmt.Errorf("unexpected connect in auth-only mode")
	})

	// 发起连接
	err = g.x224.Connect()
	if err != nil {
		return false, err
	}

	// 等待结果或超时
	select {
	case err := <-resultChan:
		if err == tpkt.ErrNLAAuthSuccess {
			return true, nil
		}
		return false, err
	case <-time.After(time.Duration(timeout*3) * time.Second):
		return false, fmt.Errorf("NLA auth timeout")
	}
}

func (g *Client) ProbeOSInfo(host, domain, user, pwd string, timeout int64, rdpProtocol uint32) (info map[string]any) {
	start := time.Now()
	exitFlag := make(chan bool, 1)
	info = make(map[string]any)

	ip := rdpTargetHost(g.Host)
	conn, err := WrapperTcpWithTimeout("tcp", g.Host, time.Duration(timeout)*time.Second)
	if err != nil {
		return
	}
	defer conn.Close()
	glog.Info(conn.LocalAddr().String())

	g.tpkt = tpkt.New(core.NewSocketLayer(conn), nla.NewNTLMv2(domain, user, pwd))
	g.x224 = x224.New(g.tpkt)

View on GitHub (pinned to 95cc12e753)

Solutions

1. Increase the timeout argument (the effective deadline is 3x this value).
2. Confirm the server responds on port 3389 and NLA is enabled — a silent server often indicates filtering.
3. Reduce concurrent probes against the same host to avoid load-induced stalls.
4. Capture a packet trace of the CredSSP exchange to see which NTLM message stalls.

Example fix

// before
ok, err := client.NlaAuthOnly("", "user", "pass", 5)
// after
ok, err := client.NlaAuthOnly("", "user", "pass", 15)

ok, err := client.NlaAuthOnly(domain, user, pwd, timeout)
if err != nil && err.Error() == "NLA auth timeout" {
	// effective deadline is timeout*3; retry once with a larger timeout
	return client.NlaAuthOnly(domain, user, pwd, timeout*2)
}

When it happens

Trigger: Server accepts the TCP dial but never responds to NTLM NEGOTIATE/CHALLENGE messages; heavily filtered networks that allow SYN but drop payload; overloaded target; overall timeout parameter too small (deadline is 3x the passed value).

Common situations: Firewalled/IDS environments that tarpit RDP; slow WAN or VPN scans; Windows hosts under load (e.g. many concurrent RDP probes); credentials being checked against a slow domain controller.

Understand the failure class

Background: Request timed out: what client-side request timeouts mean across libraries (Request timed out, TIMED_OUT, APITimeoutError) — this error's family across 39 libraries.

• Timeouts: ETIMEDOUT, deadlines, and hung requests — what actually expires when a request times out.

Related errors

• [dial err] %v
• mcs sendConnectInitial write error %v
• ReadConnectResponse %v
• mcs recvData get data error %v
• unexpected connect in auth-only mode

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/cdf37bfd5f46fe98. Report an issue: GitHub.