{"record":{"id":"d372513663067984","repo":"shadow1ng/fscan","slug":"bad-ber-tags","errorCode":null,"errorMessage":"bad BER tags","messagePattern":"bad BER tags","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/t125/mcs.go","lineNumber":109,"sourceCode":"\t\tnumPriorities, minThoughput, maxHeight, maxMCSPDUsize, protocolVersion}\n}\n\nfunc (d *DomainParameters) BER() []byte {\n\tbuff := &bytes.Buffer{}\n\tber.WriteInteger(d.MaxChannelIds, buff)\n\tber.WriteInteger(d.MaxUserIds, buff)\n\tber.WriteInteger(d.MaxTokenIds, buff)\n\tber.WriteInteger(1, buff)\n\tber.WriteInteger(0, buff)\n\tber.WriteInteger(1, buff)\n\tber.WriteInteger(d.MaxMCSPDUsize, buff)\n\tber.WriteInteger(2, buff)\n\treturn buff.Bytes()\n}\n\nfunc ReadDomainParameters(r io.Reader) (*DomainParameters, error) {\n\tif !ber.ReadUniversalTag(ber.TAG_SEQUENCE, true, r) {\n\t\treturn nil, errors.New(\"bad BER tags\")\n\t}\n\td := &DomainParameters{}\n\tber.ReadLength(r)\n\n\td.MaxChannelIds, _ = ber.ReadInteger(r)\n\td.MaxUserIds, _ = ber.ReadInteger(r)\n\td.MaxTokenIds, _ = ber.ReadInteger(r)\n\tber.ReadInteger(r)\n\tber.ReadInteger(r)\n\tber.ReadInteger(r)\n\td.MaxMCSPDUsize, _ = ber.ReadInteger(r)\n\tber.ReadInteger(r)\n\treturn d, nil\n}\n\n/**\n * @see http://www.itu.int/rec/T-REC-T.125-199802-I/en page 25\n * @param userData {Buffer}","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/t125/mcs.go#L91-L127","documentation":"ReadDomainParameters expects the server's MCS Connect Response to contain DomainParameters encoded as a BER SEQUENCE (0x30 universal tag, constructed). If ber.ReadUniversalTag(TAG_SEQUENCE, constructed=true) fails, the byte stream is not the expected BER structure. This means the MCS layer payload is malformed or out of sync.","triggerScenarios":"Called from ReadConnectResponse when parsing the server's MCS Connect Response: the first universal tag after result and calledConnectId is not a constructed SEQUENCE, i.e. the server response bytes deviate from T.125 BER encoding.","commonSituations":"The peer is not an RDP server (wrong port, HTTP banner server); a middlebox/proxy rewrites the response; a previous packet framed incorrectly so the reader is misaligned; servers that negotiate NLA and never send a plain MCS Connect Response at this point.","solutions":["Confirm the target speaks RDP on that port and that security negotiation (e.g. NLA/CredSSP) does not divert the handshake before MCS.","Hex-dump the received buffer (mcs.go already logs it) and verify the byte at the failure offset is 0x30.","Check earlier parsing steps (ReadApplicationTag, ReadEnumerated, ReadInteger) consumed the exact byte counts; a wrong length earlier desynchronizes the reader.","Return the underlying byte/tag value in the error message to ease diagnosis."],"exampleFix":"// before\nif !ber.ReadUniversalTag(ber.TAG_SEQUENCE, true, r) {\n    return nil, errors.New(\"bad BER tags\")\n}\n// after\nb, _ := core.PeekByte(r)\nif !ber.ReadUniversalTag(ber.TAG_SEQUENCE, true, r) {\n    return nil, fmt.Errorf(\"bad BER tags: expected SEQUENCE(0x30), got 0x%02x\", b)\n}","handlingStrategy":"try-catch","validationCode":"// Peek the first byte of the response before parsing MCS layers:\nfunc looksLikeBERSequence(b []byte) bool { return len(b) > 0 && b[0] == 0x30 }","typeGuard":null,"tryCatchPattern":"mcs.On(\"error\", func(err error) {\n    if strings.Contains(err.Error(), \"bad BER tags\") {\n        // peer is not speaking RDP/T.125 — abort or retry against correct host/port\n    }\n})","preventionTips":["Verify the target port actually serves RDP before running the client.","Handle NLA/CredSSP negotiation before entering the MCS layer.","Hex-log responses during development to catch desync early."],"tags":["rdp","ber","protocol-parsing","mcs"],"backgroundTag":"unexpected-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}