shadow1ng/fscan · error

invalid hash length: %s

Error message

invalid hash length: %s

What it means

Validation failure in parseHashes while parsing the -hash command-line credential: after trimming (and extracting the NT part of an LM:NT pair when the NT side is 32 chars), the hash is not exactly 32 hex characters. The offending value is fv.HashValue; the error echoes the original raw input so the user can see what was rejected.

Source

Thrown at common/config_builder.go:213

		pairs = append(pairs, filePairs...)
	}

	return pairs, nil
}

func parseHashes(fv *FlagVars) ([]string, [][]byte, error) {
	var hashValues []string
	var hashBytes [][]byte

	// 命令行哈希（支持纯 NTLM 32字符 或 LM:NT 格式）
	if fv.HashValue != "" {
		hash := strings.TrimSpace(fv.HashValue)
		// LM:NT 格式取 NT hash 部分
		if parts := strings.SplitN(hash, ":", 2); len(parts) == 2 && len(parts[1]) == 32 {
			hash = parts[1]
		}
		if len(hash) != 32 {
			return nil, nil, fmt.Errorf("invalid hash length: %s", fv.HashValue)
		}
		hashByte, err := hex.DecodeString(hash)
		if err != nil {
			return nil, nil, err
		}
		hashValues = append(hashValues, hash)
		hashBytes = append(hashBytes, hashByte)
	}

	// 从文件读取
	if fv.HashFile != "" {
		fileHashes, fileHashBytes, err := parsers.ParseHashFile(fv.HashFile)
		if err != nil {
			return nil, nil, err
		}
		hashValues = append(hashValues, fileHashes...)
		hashBytes = append(hashBytes, fileHashBytes...)
	}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Supply the NT hash as exactly 32 hexadecimal characters
2. For LM:NT input ensure the NT portion after the colon is 32 chars
3. Re-extract the hash from the target (e.g. mimikatz/SAM dump) if truncated

When it happens

Trigger: Thrown at common/config_builder.go:213 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/da14bd6f156df552. Report an issue: GitHub.