shadow1ng/fscan · error

smb_probe_failed: %w

Error message

smb_probe_failed: %w

What it means

After the port check, Scan calls probeTarget to negotiate an SMB session and gather protocol/OS information. Any error from probeTarget is wrapped as "smb_probe_failed: <cause>" using %w so the underlying cause (dial failure, negotiation failure, timeout) remains retrievable via errors.Unwrap/Is/As. It means the SMB protocol probe itself failed, not merely the port check.

Source

Thrown at plugins/services/smb.go:47

	state := session.State
	target := info.Target()

	// 检查端口
	if info.Port != 445 && info.Port != 139 {
		return &ScanResult{
			Success: false,
			Service: "smb",
			Error:   fmt.Errorf("%s", i18n.GetText("smb_port_only")),
		}
	}

	// 1. 协议探测和信息收集
	smbTarget, err := probeTarget(ctx, info.Host, info.Port, config.ModuleTimeout(), session)
	if err != nil {
		return &ScanResult{
			Success: false,
			Service: "smb",
			Error:   fmt.Errorf("%s: %w", i18n.GetText("smb_probe_failed"), err),
		}
	}

	// 输出信息收集结果
	p.logSMBInfo(target, smbTarget, session)

	// 2. 漏洞检测 (仅SMBv2+且端口445)
	if smbTarget.Protocol == SMBProtocol2 && info.Port == 445 {
		if checkSMBGhost(ctx, info.Host, config.ModuleTimeout(), session) {
			smbTarget.Vulnerable = &SMBVuln{CVE20200796: true}
			session.LogVuln(i18n.Tr("smbghost_vuln", target))
		}
	}

	// 如果禁用暴力破解，只返回信息收集结果
	if config.DisableBrute {
		return p.buildInfoResult(smbTarget)
	}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Inspect the wrapped cause with errors.Unwrap / %v of the returned error to see if it is dial, negotiation, or timeout.
2. Confirm the port truly speaks SMB (nmap --script smb-* or smbclient -L //<host>).
3. Ensure the client supports SMB2/SMB3 since SMBv1 is commonly disabled.
4. Raise the probe timeout for high-latency links and verify no middlebox resets the session.

Example fix

// before
err == nil assumption; log only "smb_probe_failed" // hides cause
// after
if err != nil { var ne net.Error; if errors.As(err, &ne) && ne.Timeout() { /* increase timeout */ } }
result.Error = fmt.Errorf("smb_probe_failed: %w", err) // preserve cause

conn, err := net.DialTimeout("tcp", host+":445", 5*time.Second)
if err == nil {
    // optional: send NBSS session request to confirm SMB before full probe
    conn.Close()
} else { /* skip: will fail smb_probe_failed anyway */ }

res, err := plugin.Scan(ctx, target)
if err != nil && strings.Contains(err.Error(), "smb_probe_failed") {
    var ne net.Error
    if errors.As(err, &ne) && ne.Timeout() {
        // increase timeout and retry once
    } else if errors.Is(err, syscall.ECONNRESET) {
        // non-SMB service or middlebox reset; skip host
    }
}

When it happens

Trigger: probeTarget returns an error — DialTCP failure, no SMB dialect negotiated (host is not SMB), session setup rejected at the protocol level, or deadline exceeded — and Scan wraps it with i18n.GetText("smb_probe_failed") at smb.go:47.

Common situations: Port open (from a prior TCP check) but the service is not SMB; SMBv1 disabled on modern Windows and the probe can't agree on SMB2/3; firewall allowing SYN but resetting SMB traffic; host firewall or tarpit causing timeouts.

Related errors

• failed to get response about exploit: %s
• failed to negotiate: %s
• ms17010_connection_error: %w
• ms17010_send_protocol_error: %w
• ms17010_smbv1_unsupported

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/7c488783756720ec. Report an issue: GitHub.