{"record":{"id":"4f3c94079ff7dc3e","repo":"shadow1ng/fscan","slug":"i18n-gettext-ms17010-aes-cipher-failed-w","errorCode":null,"errorMessage":"i18n.GetText(\"ms17010_aes_cipher_failed\"): %w","messagePattern":"i18n\\.GetText\\(\"ms17010_aes_cipher_failed\"\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010.go","lineNumber":180,"sourceCode":"\treturn &ExploitResult{\n\t\tSuccess: true,\n\t\tOutput:  output.String(),\n\t}\n}\n\n// 以下是完整的原始MS17010检测和利用代码，保持不变\n\n// AES解密函数 (从legacy/Base.go复制)\nfunc aesDecrypt(crypted string, key string) (string, error) {\n\tcryptedBytes, err := base64.StdEncoding.DecodeString(crypted)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_base64_decode_failed\"), err)\n\t}\n\n\tkeyBytes := []byte(key)\n\tblock, err := aes.NewCipher(keyBytes)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_aes_cipher_failed\"), err)\n\t}\n\n\tif len(cryptedBytes) < aes.BlockSize {\n\t\treturn \"\", fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_ciphertext_too_short\"))\n\t}\n\n\tmode := cipher.NewCBCDecrypter(block, keyBytes[:aes.BlockSize])\n\tmode.CryptBlocks(cryptedBytes, cryptedBytes)\n\n\t// 移除PKCS7填充\n\tpadding := int(cryptedBytes[len(cryptedBytes)-1])\n\tif padding > len(cryptedBytes) || padding > aes.BlockSize {\n\t\treturn \"\", fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_invalid_padding\"))\n\t}\n\n\tfor i := len(cryptedBytes) - padding; i < len(cryptedBytes); i++ {\n\t\tif cryptedBytes[i] != byte(padding) {\n\t\t\treturn \"\", fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_padding_check_failed\"))","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L162-L198","documentation":"After base64 decoding, aesDecrypt builds an AES cipher via aes.NewCipher(keyBytes). Go returns an error when the key is not 16, 24, or 32 bytes; the plugin wraps that error with \"ms17010_aes_cipher_failed\". This is purely a key-length problem — the ciphertext is not yet involved.","triggerScenarios":"Calling aesDecrypt (via executeMS17010Exploit or the init-registered path) with a key string whose byte length is not 16/24/32 — e.g. empty key, short passphrase, or key with multi-byte UTF-8 characters changing the byte count.","commonSituations":"Configuring AES-128 code with a 256-bit key or vice versa, storing the key hex-encoded instead of raw, or trimming/misspelling the key in config.","solutions":["Check len([]byte(key)) is exactly 16, 24, or 32 before calling; log the length on failure.","If the key is hex-encoded, hex.DecodeString it first to get the raw 16/24/32 bytes.","Pad or derive the key to the required size with a KDF (e.g. sha256 or PBKDF2) instead of manual padding.","Match the cipher variant to the key size: AES-128 (16B), AES-192 (24B), AES-256 (32B)."],"exampleFix":"// before\nkey := cfg.MS17010Key // could be any length\nplain, err := aesDecrypt(payload, key)\n// after: enforce key size\nkeyBytes := []byte(cfg.MS17010Key)\nif n := len(keyBytes); n != 16 && n != 24 && n != 32 {\n    return fmt.Errorf(\"aes key must be 16/24/32 bytes, got %d\", n)\n}\nplain, err := aesDecrypt(payload, cfg.MS17010Key)","handlingStrategy":"validation","validationCode":"if n := len([]byte(key)); n != 16 && n != 24 && n != 32 {\n    return fmt.Errorf(\"aes key must be 16/24/32 bytes, got %d\", n)\n}","typeGuard":null,"tryCatchPattern":"if _, err := aes.NewCipher([]byte(key)); err != nil {\n    return fmt.Errorf(\"invalid aes key: %w\", err)\n}","preventionTips":["Store keys as raw 16/24/32-byte material, not hex/base64 strings","Document which AES variant (128/192/256) the plugin expects","Validate key length at config load time"],"tags":["go","aes","key-size","crypto","ms17010"],"backgroundTag":"invalid-argument-value","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}