{"record":{"id":"5ff1b666d6f90f15","repo":"shadow1ng/fscan","slug":"i18n-gettext-ms17010-base64-decode-failed-w","errorCode":null,"errorMessage":"i18n.GetText(\"ms17010_base64_decode_failed\"): %w","messagePattern":"i18n\\.GetText\\(\"ms17010_base64_decode_failed\"\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010.go","lineNumber":174,"sourceCode":"\t\toutput.WriteString(i18n.GetText(\"ms17010_exploit_shellcode_hint\") + \"\\n\")\n\t\toutput.WriteString(i18n.GetText(\"ms17010_exploit_supported_modes\") + \"\\n\")\n\t}\n\n\tsession.LogSuccess(i18n.Tr(\"ms17010_complete\", target))\n\n\treturn &ExploitResult{\n\t\tSuccess: true,\n\t\tOutput:  output.String(),\n\t}\n}\n\n// 以下是完整的原始MS17010检测和利用代码，保持不变\n\n// AES解密函数 (从legacy/Base.go复制)\nfunc aesDecrypt(crypted string, key string) (string, error) {\n\tcryptedBytes, err := base64.StdEncoding.DecodeString(crypted)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_base64_decode_failed\"), err)\n\t}\n\n\tkeyBytes := []byte(key)\n\tblock, err := aes.NewCipher(keyBytes)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_aes_cipher_failed\"), err)\n\t}\n\n\tif len(cryptedBytes) < aes.BlockSize {\n\t\treturn \"\", fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_ciphertext_too_short\"))\n\t}\n\n\tmode := cipher.NewCBCDecrypter(block, keyBytes[:aes.BlockSize])\n\tmode.CryptBlocks(cryptedBytes, cryptedBytes)\n\n\t// 移除PKCS7填充\n\tpadding := int(cryptedBytes[len(cryptedBytes)-1])\n\tif padding > len(cryptedBytes) || padding > aes.BlockSize {","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L156-L192","documentation":"aesDecrypt wraps a base64.StdEncoding.DecodeString failure with the \"ms17010_base64_decode_failed\" message and the underlying error (%w). The plugin decrypts its payload/config data with this helper, so any input that is not valid canonical base64 makes the whole decrypt — and thus executeMS17010Exploit — fail.","triggerScenarios":"Passing a crypted string containing whitespace, URL-safe base64 characters (-/ _), missing padding, or raw binary/hex to aesDecrypt (via executeMS17010Exploit).","commonSituations":"Payloads copy-pasted with spaces/newlines, data encoded with URLEncoding instead of StdEncoding, hex-encoded blobs mistakenly treated as base64, or corrupted config values.","solutions":["Validate the payload is canonical std base64 before calling: base64.StdEncoding.DecodeString in a dry run or a regex ^[A-Za-z0-9+/]*={0,2}$.","Strip whitespace/newlines from the payload before decryption.","If the producer used URL-safe base64, re-encode or swap the decoder to base64.URLEncoding.","Inspect the wrapped %w error with errors.Unwrap to see the exact CorruptInputError offset."],"exampleFix":"// before\nplain, err := aesDecrypt(payload, key)\n// after: sanitize and disambiguate encoding\ncleaned := strings.Map(func(r rune) rune {\n    if unicode.IsSpace(r) { return -1 }\n    return r\n}, payload)\nif b, err := base64.StdEncoding.DecodeString(cleaned); err != nil {\n    return fmt.Errorf(\"payload not std base64: %w\", err)\n}\nplain, err := aesDecrypt(cleaned, key)","handlingStrategy":"validation","validationCode":"if _, err := base64.StdEncoding.DecodeString(payload); err != nil {\n    return fmt.Errorf(\"payload is not valid std base64: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"plain, err := aesDecrypt(payload, key)\nif err != nil {\n    var base64Err base64.CorruptInputError\n    if errors.As(err, &base64Err) {\n        return fmt.Errorf(\"bad base64 at offset %d\", int64(base64Err))\n    }\n    return err\n}","preventionTips":["Strip whitespace/newlines from encoded payloads","Standardize on std base64 (not URL-safe or hex) for payload exchange","Round-trip test encode/decode in CI"],"tags":["go","base64","aes","decoding","ms17010"],"backgroundTag":"invalid-argument-format","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}