shadow1ng/fscan · error

smbv2_session_read_failed

Error message

smbv2_session_read_failed: %w

What it means

Guard in probeSMBv2: reading the Session Setup response failed, so the NTLM challenge the server would embed in that reply is never obtained and SMBv2 fingerprinting stops before the NTLM exchange.

Solutions

1. Retry with a longer deadline
2. Confirm the server issues an NTLM challenge on session setup
3. Check for IPS dropping mid-handshake SMB traffic

When it happens

Trigger: Thrown at plugins/services/smb_protocol.go:330 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/db35b51471840c68. Report an issue: GitHub.

Appendix: source

Thrown at plugins/services/smb_protocol.go:330

	// 构建NTLM数据包
	var ntlmData []byte
	if len(r2) > 70 && hex.EncodeToString(r2[70:71]) == "03" {
		flags := []byte{0x15, 0x82, 0x08, 0xa0}
		ntlmData = buildNTLMSSPData(flags)
	} else {
		flags := []byte{0x05, 0x80, 0x08, 0xa0}
		ntlmData = buildNTLMSSPData(flags)
	}

	// 发送Session Setup
	_, err = conn2.Write(smbv2SessionSetupPacket)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("smbv2_session_send_failed"), err)
	}

	_, err = readSMBMessage(conn2)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("smbv2_session_read_failed"), err)
	}

	// 发送NTLM协商包
	_, err = conn2.Write(ntlmData)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("smbv2_ntlm_send_failed"), err)
	}

	ret, err := readSMBMessage(conn2)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("smbv2_ntlm_read_failed"), err)
	}

	ntlmOff := bytes.Index(ret, []byte("NTLMSSP"))
	if ntlmOff == -1 {
		return &SMBTarget{Protocol: SMBProtocol2}, nil
	}

View on GitHub (pinned to 95cc12e753)