{"record":{"id":"9b84c17733252a1d","repo":"shadow1ng/fscan","slug":"ms17010-shellcode-decode-failed-w","errorCode":null,"errorMessage":"ms17010_shellcode_decode_failed: %w","messagePattern":"ms17010_shellcode_decode_failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010.go","lineNumber":469,"sourceCode":"\t\t\tread, err := os.ReadFile(shellcode[5:])\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_shellcode_file_read_failed\"), err)\n\t\t\t}\n\t\t\tsc = fmt.Sprintf(\"%x\", read)\n\t\t} else {\n\t\t\tsc = shellcode\n\t\t}\n\t}\n\n\t// 验证shellcode有效性\n\tif len(sc) < 20 {\n\t\treturn fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_invalid_shellcode\"))\n\t}\n\n\t// 解码shellcode\n\tscBytes, err := hex.DecodeString(sc)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_shellcode_decode_failed\"), err)\n\t}\n\n\tif err = eternalBlue(net.JoinHostPort(info.Host, \"445\"), 12, 12, scBytes); err != nil {\n\t\treturn fmt.Errorf(\"MS17-010 exp failed: %w\", err)\n\t}\n\n\tsession.LogSuccess(i18n.Tr(\"ms17010_shellcode_complete\", info.Host, len(scBytes)))\n\treturn nil\n}\n\n// init 自动注册插件\nfunc init() {\n\t// 使用高效注册方式：直接传递端口信息，避免实例创建\n\tRegisterPluginWithPorts(\"ms17010\", func() Plugin {\n\t\treturn NewMS17010Plugin()\n\t}, []int{445})\n}\n","sourceCodeStart":451,"sourceCodeEnd":487,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L451-L487","documentation":"The plugin failed to hex-decode the shellcode string before feeding it to EternalBlue. Go's hex.DecodeString requires an even-length string of [0-9a-fA-F]; this error wraps that decode failure. The library throws it because the shellcode input was not valid hex, so no byte payload can be constructed.","triggerScenarios":"Setting config.Shellcode to a raw string that is not hex (e.g. shellcode containing \"\\xfc\\x48\\x83...\" escaped bytes, base64, or non-hex characters); a `file:`-referenced file whose content is not hex; or an odd-length hex string.","commonSituations":"Pasting Metasploit/Cobalt Strike shellcode in \\x-escaped or raw binary form instead of plain hex; using a C-array string like \"\\xfc\\xe8...\"; copying hex with whitespace, 0x prefixes, or a trailing newline; providing an odd number of hex digits.","solutions":["Convert the shellcode to plain lowercase hex with no prefixes, whitespace, or separators (e.g. with Python: `open('sc.bin','rb').read().hex()`, or msfvenom -f hex).","Remove \"0x\", commas, quotes, \"\\\\x\" sequences, and any whitespace/newlines from the string.","Ensure the hex string has an even number of characters.","Check the wrapped %w error in logs — it names the exact byte position and invalid character that broke decoding.","If loading from a file, make sure the file contains hex text, not raw binary (the plugin hex-formats the raw bytes itself via %x, so raw binary in a `file:` path is actually fine — only non-binary garbage like text fails)."],"exampleFix":"// before\nshellcode = \"\\xfc\\x48\\x83\\xe4\\xf0\\xe8\"          // \\x-escaped, not hex text\n// after\nshellcode = \"fc4883e4f0e8\"                          // plain hex, even length","handlingStrategy":"validation","validationCode":"sc := strings.Map(func(r rune) rune { return unicode.ToLower(r) }, strings.TrimSpace(rawShellcode))\nif len(sc) == 0 || len(sc)%2 != 0 {\n    return errors.New(\"shellcode hex string must have even, non-zero length\")\n}\nif _, err := hex.DecodeString(sc); err != nil {\n    return fmt.Errorf(\"invalid hex shellcode: %w\", err)\n}","typeGuard":"func isHexString(s string) bool {\n    if len(s) == 0 || len(s)%2 != 0 { return false }\n    _, err := hex.DecodeString(s)\n    return err == nil\n}","tryCatchPattern":"scBytes, err := hex.DecodeString(sc)\nif err != nil {\n    return fmt.Errorf(\"shellcode is not valid hex (pos %v): %w\", err, err)\n}","preventionTips":["Generate shellcode with `msfvenom -f hex` so output is hex-safe by construction.","Strip 0x prefixes, \\\\x escapes, whitespace, and quotes before passing shellcode.","Round-trip check: hex-encode and decode once in a unit test for your config pipeline.","Store shellcode in files as raw binary (the plugin hex-formats via %x) rather than hand-pasting hex text."],"tags":["go","encoding","hex-decode","shellcode","input-validation"],"backgroundTag":"invalid-argument-format","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}