shadow1ng/fscan · error

service_auth_failed

Error message

service_auth_failed

What it means

Guard at the end of RDPPlugin.Scan: every credential pair was tried and none authenticated successfully (no 'dial err' among failures), so the scan concludes with the shared auth-failed sentinel for the RDP service.

Source

Thrown at plugins/services/rdp.go:156

			}
		}

		// 记录失败（仅调试时）
		if err != nil && strings.Contains(err.Error(), "dial err") {
			// 端口未开放，直接返回
			return &ScanResult{
				Success: false,
				Service: "rdp",
				Error:   fmt.Errorf("%s", i18n.GetText("rdp_port_closed")),
			}
		}
	}

	// 所有凭据都失败
	return &ScanResult{
		Success: false,
		Service: "rdp",
		Error:   fmt.Errorf("%s", i18n.GetText("service_auth_failed")),
	}
}

// rdpCrack 使用NLA认证验证凭据，不建立完整会话，不会挤掉已登录用户
func (p *RDPPlugin) rdpCrack(host, domain, user, password string, config *common.Config, state *common.State) (bool, error) {
	timeout := int64(config.ModuleTimeout().Seconds())

	// 使用NLA仅验证模式：只验证凭据，不建立RDP会话
	// 这样不会挤掉目标机器上已登录的用户
	success, err := login.NlaAuth(host, domain, user, password, timeout)
	if success {
		state.IncrementTCPSuccessPacketCount()
		return true, nil
	}

	if err != nil && strings.Contains(err.Error(), "dial err") {
		state.IncrementTCPFailedPacketCount()
		return false, err

View on GitHub (pinned to 95cc12e753)

Solutions

1. Expand the credential dictionary
2. Verify NLA/domain settings match the target environment
3. Check whether account lockout policy is now blocking logons

When it happens

Trigger: Thrown at plugins/services/rdp.go:156 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/dfd2a4f262157138. Report an issue: GitHub.