shadow1ng/fscan · error

rdp_port_closed

Error message

rdp_port_closed

What it means

Guard in RDPPlugin.Scan: an rdpCrack error containing 'dial err' indicates the TCP connection to the RDP port could not be established, so all remaining credentials are skipped and the port is reported as closed instead of auth-failed.

Source

Thrown at plugins/services/rdp.go:147

			session.LogVuln(result)

			return &ScanResult{
				Success:  true,
				Type:     plugins.ResultTypeCredential,
				Service:  "rdp",
				Username: cred.Username,
				Password: cred.Password,
				Banner:   p.buildBanner(osInfo),
			}
		}

		// 记录失败（仅调试时）
		if err != nil && strings.Contains(err.Error(), "dial err") {
			// 端口未开放，直接返回
			return &ScanResult{
				Success: false,
				Service: "rdp",
				Error:   fmt.Errorf("%s", i18n.GetText("rdp_port_closed")),
			}
		}
	}

	// 所有凭据都失败
	return &ScanResult{
		Success: false,
		Service: "rdp",
		Error:   fmt.Errorf("%s", i18n.GetText("service_auth_failed")),
	}
}

// rdpCrack 使用NLA认证验证凭据，不建立完整会话，不会挤掉已登录用户
func (p *RDPPlugin) rdpCrack(host, domain, user, password string, config *common.Config, state *common.State) (bool, error) {
	timeout := int64(config.ModuleTimeout().Seconds())

	// 使用NLA仅验证模式：只验证凭据，不建立RDP会话
	// 这样不会挤掉目标机器上已登录的用户

View on GitHub (pinned to 95cc12e753)

Solutions

1. Verify the RDP port (3389 or custom) is open
2. Check firewall/Network Level Authentication reachability
3. Increase connection timeout for slow targets

When it happens

Trigger: Thrown at plugins/services/rdp.go:147 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/40f8296526d7e653. Report an issue: GitHub.