{"record":{"id":"6e914802516e2458","repo":"shadow1ng/fscan","slug":"ms17010-invalid-shellcode","errorCode":null,"errorMessage":"ms17010_invalid_shellcode","messagePattern":"ms17010_invalid_shellcode","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010.go","lineNumber":463,"sourceCode":"\t\tsc = \"\"\n\n\tdefault:\n\t\t// 从文件读取或直接使用提供的shellcode\n\t\tshellcode := config.Shellcode\n\t\tif strings.Contains(shellcode, \"file:\") {\n\t\t\tread, err := os.ReadFile(shellcode[5:])\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_shellcode_file_read_failed\"), err)\n\t\t\t}\n\t\t\tsc = fmt.Sprintf(\"%x\", read)\n\t\t} else {\n\t\t\tsc = shellcode\n\t\t}\n\t}\n\n\t// 验证shellcode有效性\n\tif len(sc) < 20 {\n\t\treturn fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_invalid_shellcode\"))\n\t}\n\n\t// 解码shellcode\n\tscBytes, err := hex.DecodeString(sc)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_shellcode_decode_failed\"), err)\n\t}\n\n\tif err = eternalBlue(net.JoinHostPort(info.Host, \"445\"), 12, 12, scBytes); err != nil {\n\t\treturn fmt.Errorf(\"MS17-010 exp failed: %w\", err)\n\t}\n\n\tsession.LogSuccess(i18n.Tr(\"ms17010_shellcode_complete\", info.Host, len(scBytes)))\n\treturn nil\n}\n\n// init 自动注册插件\nfunc init() {","sourceCodeStart":445,"sourceCodeEnd":481,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L445-L481","documentation":"The MS17-010 plugin rejects a shellcode string shorter than 20 hex characters (<10 bytes) before attempting EternalBlue. The library throws it because a payload that small cannot contain a meaningful kernel/user payload, and running the exploit with it would waste attempts or crash the target. It acts as an input sanity check on the resolved shellcode string (from config, file, or decrypted preset).","triggerScenarios":"Calling the ms17010 plugin with config.Shellcode set to \"cs\" (hardcoded to empty string at ms17010.go:445), a custom shellcode string of fewer than 20 characters, or a `file:`-referenced file shorter than 10 bytes — any path where the final `sc` string length < 20.","commonSituations":"Operators leaving Shellcode=\"cs\" in the config without supplying an actual Cobalt Strike payload elsewhere; pasting a truncated hex string; pointing `file:` at an empty or stub file; or a decryption path silently yielding a short/garbage string.","solutions":["Set config.Shellcode to a valid payload type (\"bind\", \"add\", \"guest\") or a hex-encoded shellcode string of at least 10 bytes (20 hex chars).","If using `file:<path>`, ensure the file contains real shellcode bytes, not an empty or placeholder file.","Avoid the built-in \"cs\" value unless you have patched the plugin to supply the actual CS payload, since it resolves to an empty string and always fails.","Validate the hex string length client-side before launching the scan (see defense strategies)."],"exampleFix":"// before (config)\nshellcode = \"cs\"  // resolves to empty string, always fails\n// after\nshellcode = \"bind\" // or a hex string like \"fc4883e4f0e8c0...\" (>= 20 hex chars)","handlingStrategy":"validation","validationCode":"sc := strings.TrimSpace(config.Shellcode)\nif sc == \"cs\" || len(sc) < 20 {\n    return fmt.Errorf(\"shellcode must be a hex string of >= 20 chars; got %q (len=%d)\", sc, len(sc))\n}","typeGuard":"func isValidShellcode(sc string) bool {\n    return len(sc) >= 20 && len(sc)%2 == 0 && regexp.MustCompile(`^[0-9a-fA-F]+$`).MatchString(sc)\n}","tryCatchPattern":null,"preventionTips":["Never leave Shellcode set to \"cs\" unless the plugin provides the actual CS payload.","Pre-validate shellcode length and hex-ness in a startup config check.","When using `file:` paths, assert the file is non-empty and >= 10 bytes before scanning.","Log the resolved shellcode length at debug level to catch truncation early."],"tags":["go","input-validation","shellcode","ms17010","config"],"backgroundTag":"empty-required-field","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}