shadow1ng/fscan · info

%s

Error message

%s

What it means

The FindNet plugin only operates on Windows RPC endpoint mapper port 135; Scan rejects any other port up front with i18n key service_port_restricted, naming the service and the required port. It is a deliberate input guard, not a runtime failure — the protocol cannot function on a different port.

Source

Thrown at plugins/services/findnet.go:49

func NewFindNetPlugin() *FindNetPlugin {
	return &FindNetPlugin{
		BasePlugin: plugins.NewBasePlugin("findnet"),
	}
}

// GetPorts 实现Plugin接口

// Scan 执行FindNet扫描 - Windows网络信息收集
func (p *FindNetPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
	config := session.Config
	target := info.Target()

	// 检查是否为RPC端口
	if info.Port != 135 {
		return &ScanResult{
			Success: false,
			Service: "findnet",
			Error:   fmt.Errorf("%s", i18n.Tr("service_port_restriction", "FindNet", "135")),
		}
	}

	conn, err := session.DialTCP(ctx, "tcp", target, config.ModuleTimeout())
	if err != nil {
		return &ScanResult{
			Success: false,
			Service: "findnet",
			Error:   fmt.Errorf(i18n.Tr("service_conn_port_failed", "%w"), err),
		}
	}
	defer func() { _ = conn.Close() }()

	// 设置超时
	_ = conn.SetDeadline(time.Now().Add(config.ModuleTimeout()))

	// 执行RPC网络发现
	networkInfo, err := p.performNetworkDiscovery(conn)

View on GitHub (pinned to 95cc12e753)

Solutions

1. Restrict the target list for the findnet module to port 135 hosts.
2. If scanning a different port is intentional, use the appropriate plugin (e.g. smb/netbios plugins for 445/139).
3. Filter plugin invocation by port so port-aware registration (RegisterPluginWithPorts) routes only 135 targets to findnet.
4. No code fix applies — the port restriction is by protocol design.

Example fix

// before
res := findnetPlugin.Scan(ctx, &common.HostInfo{Host: "10.0.0.5", Port: 445}, session)
// after
if info.Port == 135 {
    res = findnetPlugin.Scan(ctx, info, session)
} else {
    res = smbPlugin.Scan(ctx, info, session)
}

if info.Port != 135 {
    return fmt.Errorf("findnet requires port 135, got %d; use another plugin", info.Port)
}

res := plugin.Scan(ctx, info, session)
if !res.Success && res.Error != nil && strings.Contains(res.Error.Error(), "135") {
    log.Printf("wrong port %d for findnet; routing to smb plugin", info.Port)
    res = smbPlugin.Scan(ctx, info, session)
}

When it happens

Trigger: Calling the findnet plugin's Scan (directly or via the plugin registry) with a HostInfo whose Port is anything other than 135.

Common situations: Auto-discovery feeding the plugin ports found open on the host (e.g. 445, 139); a misconfigured target list that includes non-RPC ports; running the plugin against a non-Windows host where the port mapping is meaningless.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• service_conn_port_failed: %w
• minidump_admin_required
• minidump_all_methods_failed
• failed to write realtime backup: %w
• failed to sync realtime backup: %w

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/e2aa6024cbbd468e. Report an issue: GitHub.