{"record":{"id":"3e98e500429bbd90","repo":"sqlmapproject/sqlmap","slug":"malformed-kdc-reply","errorCode":null,"errorMessage":"malformed KDC reply","messagePattern":"malformed KDC reply","errorType":"exception","errorClass":"KerberosError","httpStatus":null,"severity":"error","filePath":"extra/kerberos/client.py","lineNumber":229,"sourceCode":"        raise KerberosError(-1, \"KDC advertised an out-of-policy string-to-key iteration count (%d)\" % iterations)\n    return iterations\n\ndef _hintFor(hints, etype, salt, chosenSalt):\n    \"\"\"Apply the hint for 'etype': its salt (unless the caller pinned one) and its work factor.\"\"\"\n\n    advertisedSalt, iterations = hints.get(etype, (None, None))\n    if salt is None and advertisedSalt is not None:\n        chosenSalt = advertisedSalt\n    return chosenSalt, _validatedIterations(iterations)\n\ndef _replyEtype(response):\n    \"\"\"Return the etype of a KDC-REP's enc-part (which etype the KDC used for the client's key).\"\"\"\n\n    try:\n        rep = _fields(der.peel(der.peel(response)[1])[1])\n        return _expInteger(_expFields(rep[6])[0])\n    except (KeyError, IndexError, ValueError, struct.error):\n        raise KerberosError(-1, \"malformed KDC reply\")\n\ndef _parseRep(response, key, usage, expectedNonce, expectedType):\n    \"\"\"Parse an AS-REP / TGS-REP: decrypt its enc-part with 'key' under 'usage', returning the\n    opaque ticket and the freshly issued session key. The two replies are structurally identical.\n    The reply's application tag MUST match the expected message type, and the nonce carried in the\n    (integrity-protected) enc-part MUST equal the request nonce (RFC 4120).\"\"\"\n\n    try:                                                   # any structural defect in a hostile/truncated reply -> KerberosError\n        tag, repContent = _raiseIfError(response)\n        if tag != der.applicationTag(expectedType):\n            raise KerberosError(-1, \"unexpected reply message type (tag 0x%02x)\" % tag)\n        rep = _fields(der.peel(repContent)[1])\n        encData = _expFields(rep[6])                        # enc-part (EncryptedData)\n        repEtype = _expInteger(encData[0])\n        try:\n            encRepPart = _enctype(repEtype).decrypt(key, usage, _expOctet(encData[2]))\n        except ValueError:                                 # HMAC mismatch -> we hold the wrong long-term key\n            raise KerberosError(-1, \"reply decryption failed (wrong password or salt)\")","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/sqlmapproject/sqlmap/blob/0a35b20e3953d341be6c7ac75ccb0b3362540c8d/extra/kerberos/client.py#L211-L247","documentation":"_replyEtype wraps DER parsing of the AS-REP: it peels the application wrapper and the enc-part to read field 6 (etype). Any KeyError/IndexError/ValueError/struct.error — meaning a truncated, non-ASN.1, or structurally wrong reply from the network — is converted into this generic KerberosError instead of leaking raw parse exceptions.","triggerScenarios":"Thrown at extra/kerberos/client.py:229 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm the KDC host/port points at a real KDC speaking Kerberos, not another service.","Check whether a proxy is truncating or rewriting the reply.","Decode the raw reply bytes manually to find the malformed field.","Retry against a different KDC in the realm."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0a35b20e3953d341be6c7ac75ccb0b3362540c8d","analyzedAt":"2026-08-26T23:02:52.002Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}