shadow1ng/fscan · error

NTLM hash authentication failed

Error message

NTLM hash authentication failed

What it means

Guard in doNTLMHashAuth: NTLMBindWithHash failed, so pass-the-hash authentication with the provided domain/username/NTLM-hash combination was rejected by the LDAP server. The connection is closed and the attempt is classified as ErrorTypeAuth (bad hash, wrong domain, or NTLM not permitted).

Solutions

1. Verify the NTLM hash is the correct format (32 hex chars) and matches the account
2. Confirm the domain component is correct for the target AD forest
3. Check whether the account is locked out or NTLM authentication is disabled by policy

When it happens

Trigger: Thrown at plugins/services/ldap.go:198 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/6294f3d50b101e6e. Report an issue: GitHub.

Appendix: source

Thrown at plugins/services/ldap.go:198

	stopCancelClose := context.AfterFunc(ctx, func() {
		_ = conn.Close()
	})
	defer stopCancelClose()

	if err := conn.NTLMBindWithHash(domain, username, hash); err == nil {
		return &AuthResult{
			Success:   true,
			Conn:      &ldapConnWrapper{conn},
			ErrorType: ErrorTypeUnknown,
			Error:     nil,
		}
	}

	_ = conn.Close()
	return &AuthResult{
		Success:   false,
		ErrorType: ErrorTypeAuth,
		Error:     fmt.Errorf("NTLM hash authentication failed"),
	}
}

// connectLDAP 连接LDAP服务器
func (p *LDAPPlugin) connectLDAP(ctx context.Context, info *common.HostInfo, session *common.ScanSession) (*ldaplib.Conn, error) {
	target := info.Target()

	type result struct {
		conn *ldaplib.Conn
		err  error
	}
	resultChan := make(chan result, 1)

	go func() {
		tcpConn, err := session.DialTCP(ctx, "tcp", target, session.Config.ModuleTimeout())
		if err != nil {
			resultChan <- result{nil, err}
			return

View on GitHub (pinned to 95cc12e753)