shadow1ng/fscan · error

smbv2_ntlm_read_failed

Error message

smbv2_ntlm_read_failed: %w

What it means

Guard in probeSMBv2: reading the response to the NTLM negotiation failed, so no NTLMSSP AUTH/challenge blob is available to parse (ntlmOff search never happens) and the SMB fingerprint cannot be completed.

Solutions

1. Retry the probe with adjusted timeouts
2. Confirm the server completes NTLM exchanges anonymously
3. Check connection stability

When it happens

Trigger: Thrown at plugins/services/smb_protocol.go:341 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/572e6c322f2499bd. Report an issue: GitHub.

Appendix: source

Thrown at plugins/services/smb_protocol.go:341

	_, err = conn2.Write(smbv2SessionSetupPacket)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("smbv2_session_send_failed"), err)
	}

	_, err = readSMBMessage(conn2)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("smbv2_session_read_failed"), err)
	}

	// 发送NTLM协商包
	_, err = conn2.Write(ntlmData)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("smbv2_ntlm_send_failed"), err)
	}

	ret, err := readSMBMessage(conn2)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("smbv2_ntlm_read_failed"), err)
	}

	ntlmOff := bytes.Index(ret, []byte("NTLMSSP"))
	if ntlmOff == -1 {
		return &SMBTarget{Protocol: SMBProtocol2}, nil
	}

	info := &SMBTarget{
		Protocol: SMBProtocol2,
	}

	parseNTLMChallenge(ret[ntlmOff:], info)
	return info, nil
}

// checkSMBGhost 检测CVE-2020-0796漏洞
func checkSMBGhost(ctx context.Context, host string, timeout time.Duration, session *common.ScanSession) bool {
	addr := fmt.Sprintf("%s:445", host)

View on GitHub (pinned to 95cc12e753)