shadow1ng/fscan · error

smbv2_ntlm_send_failed: %w

Error message

smbv2_ntlm_send_failed: %w

What it means

Guard in probeSMBv2: writing the constructed NTLMSSP NEGOTIATE packet failed after session setup completed. The NTLM negotiation that yields server version info cannot be sent, aborting the fingerprint attempt.

Source

Thrown at plugins/services/smb_protocol.go:336

		flags := []byte{0x05, 0x80, 0x08, 0xa0}
		ntlmData = buildNTLMSSPData(flags)
	}

	// 发送Session Setup
	_, err = conn2.Write(smbv2SessionSetupPacket)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("smbv2_session_send_failed"), err)
	}

	_, err = readSMBMessage(conn2)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("smbv2_session_read_failed"), err)
	}

	// 发送NTLM协商包
	_, err = conn2.Write(ntlmData)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("smbv2_ntlm_send_failed"), err)
	}

	ret, err := readSMBMessage(conn2)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("smbv2_ntlm_read_failed"), err)
	}

	ntlmOff := bytes.Index(ret, []byte("NTLMSSP"))
	if ntlmOff == -1 {
		return &SMBTarget{Protocol: SMBProtocol2}, nil
	}

	info := &SMBTarget{
		Protocol: SMBProtocol2,
	}

	parseNTLMChallenge(ret[ntlmOff:], info)
	return info, nil

View on GitHub (pinned to 95cc12e753)

Solutions

1. Retry the NTLM exchange on a new connection
2. Increase the deadline
3. Verify no security device is resetting NTLM traffic

When it happens

Trigger: Thrown at plugins/services/smb_protocol.go:336 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/95c0708c145e2ec0. Report an issue: GitHub.