What causes "ms17010_padding_check_failed" in shadow1ng/fscan?

Double-check the key and IV derivation on both sides; a single wrong byte in the last block trips this check.

ms17010_padding_check_failed

Error message

ms17010_padding_check_failed

What it means

After reading the PKCS7 padding length, aesDecrypt verifies every padding byte equals the padding value; a mismatch raises "ms17010_padding_check_failed". This is the standard PKCS7 integrity check and almost always indicates the data decrypted to garbage (wrong key/IV) or was not PKCS7-padded.

Source

Thrown at plugins/services/ms17010.go:198

		return "", fmt.Errorf("%s: %w", i18n.GetText("ms17010_aes_cipher_failed"), err)
	}

	if len(cryptedBytes) < aes.BlockSize {
		return "", fmt.Errorf("%s", i18n.GetText("ms17010_ciphertext_too_short"))
	}

	mode := cipher.NewCBCDecrypter(block, keyBytes[:aes.BlockSize])
	mode.CryptBlocks(cryptedBytes, cryptedBytes)

	// 移除PKCS7填充
	padding := int(cryptedBytes[len(cryptedBytes)-1])
	if padding > len(cryptedBytes) || padding > aes.BlockSize {
		return "", fmt.Errorf("%s", i18n.GetText("ms17010_invalid_padding"))
	}

	for i := len(cryptedBytes) - padding; i < len(cryptedBytes); i++ {
		if cryptedBytes[i] != byte(padding) {
			return "", fmt.Errorf("%s", i18n.GetText("ms17010_padding_check_failed"))
		}
	}

	return string(cryptedBytes[:len(cryptedBytes)-padding]), nil
}

// 默认AES解密密钥 (从legacy代码复制)
var defaultKey = "0123456789abcdef"

// SMB协议加密的请求数据 (从原始MS17010.go复制)
var (
	negotiateProtocolRequestEnc  = "G8o+kd/4y8chPCaObKK8L9+tJVFBb7ntWH/EXJ74635V3UTXA4TFOc6uabZfuLr0Xisnk7OsKJZ2Xdd3l8HNLdMOYZXAX5ZXnMC4qI+1d/MXA2TmidXeqGt8d9UEF5VesQlhP051GGBSldkJkVrP/fzn4gvLXcwgAYee3Zi2opAvuM6ScXrMkcbx200ThnOOEx98/7ArteornbRiXQjnr6dkJEUDTS43AW6Jl3OK2876Yaz5iYBx+DW5WjiLcMR+b58NJRxm4FlVpusZjBpzEs4XOEqglk6QIWfWbFZYgdNLy3WaFkkgDjmB1+6LhpYSOaTsh4EM0rwZq2Z4Lr8TE5WcPkb/JNsWNbibKlwtNtp94fIYvAWgxt5mn/oXpfUD"
	sessionSetupRequestEnc       = "52HeCQEbsSwiSXg98sdD64qyRou0jARlvfQi1ekDHS77Nk/8dYftNXlFahLEYWIxYYJ8u53db9OaDfAvOEkuox+p+Ic1VL70r9Q5HuL+NMyeyeN5T5el07X5cT66oBDJnScs1XdvM6CBRtj1kUs2h40Z5Vj9EGzGk99SFXjSqbtGfKFBp0DhL5wPQKsoiXYLKKh9NQiOhOMWHYy/C+Iwhf3Qr8d1Wbs2vgEzaWZqIJ3BM3z+dhRBszQoQftszC16TUhGQc48XPFHN74VRxXgVe6xNQwqrWEpA4hcQeF1+QqRVHxuN+PFR7qwEcU1JbnTNISaSrqEe8GtRo1r2rs7+lOFmbe4qqyUMgHhZ6Pwu1bkhrocMUUzWQBogAvXwFb8"
	treeConnectRequestEnc        = "+b/lRcmLzH0c0BYhiTaYNvTVdYz1OdYYDKhzGn/3T3P4b6pAR8D+xPdlb7O4D4A9KMyeIBphDPmEtFy44rtto2dadFoit350nghebxbYA0pTCWIBd1kN0BGMEidRDBwLOpZE6Qpph/DlziDjjfXUz955dr0cigc9ETHD/+f3fELKsopTPkbCsudgCs48mlbXcL13GVG5cGwKzRuP4ezcdKbYzq1DX2I7RNeBtw/vAlYh6etKLv7s+YyZ/r8m0fBY9A57j+XrsmZAyTWbhPJkCg=="
	transNamedPipeRequestEnc     = "k/RGiUQ/tw1yiqioUIqirzGC1SxTAmQmtnfKd1qiLish7FQYxvE+h4/p7RKgWemIWRXDf2XSJ3K0LUIX0vv1gx2eb4NatU7Qosnrhebz3gUo7u25P5BZH1QKdagzPqtitVjASpxIjB3uNWtYMrXGkkuAm8QEitberc+mP0vnzZ8Nv/xiiGBko8O4P/wCKaN2KZVDLbv2jrN8V/1zY6fvWA=="
	trans2SessionSetupRequestEnc = "JqNw6PUKcWOYFisUoUCyD24wnML2Yd8kumx9hJnFWbhM2TQkRvKHsOMWzPVfggRrLl8sLQFqzk8bv8Rpox3uS61l480Mv7HdBPeBeBeFudZMntXBUa4pWUH8D9EXCjoUqgAdvw6kGbPOOKUq3WmNb0GDCZapqQwyUKKMHmNIUMVMAOyVfKeEMJA6LViGwyvHVMNZ1XWLr0xafKfEuz4qoHiDyVWomGjJt8DQd6+jgLk="

	// SMB协议解密后的请求数据

View on GitHub (pinned to 95cc12e753)

Solutions

Double-check the key and IV derivation on both sides; a single wrong byte in the last block trips this check.
Confirm the encryptor uses PKCS7; if it uses zero-padding, strip manually instead of using this validator.
Add a MAC (e.g. HMAC or use AES-GCM) to distinguish corruption from padding errors.
Retry with the exact original key material if a KDF/encoding step (hex vs raw) may have been skipped.

Example fix

// before: silent assumption of PKCS7
plain, err := aesDecrypt(payload, key)
// after: inspect the real padding when diagnostics are needed
raw, _ := base64.StdEncoding.DecodeString(payload)
log.Printf("last block bytes: %x", raw[len(raw)-aes.BlockSize:])
plain, err := aesDecrypt(payload, key)
if err != nil && strings.Contains(err.Error(), "padding") {
    return fmt.Errorf("wrong key or non-PKCS7 padding: %w", err)
}

Defensive patterns

Strategy: try-catch

Try / catch

plain, err := aesDecrypt(payload, key)
if err != nil {
    if strings.Contains(err.Error(), "padding_check_failed") {
        return fmt.Errorf("wrong key or non-PKCS7 padding: %w", err)
    }
    return err
}

Prevention

Keep key material in sync between producer and consumer (version keys)
Confirm the encryptor's padding scheme is PKCS7
Test decrypt with a known-good sample on every key change

When it happens

Trigger: aesDecrypt succeeds at decryption but the trailing bytes are not uniform: wrong key, wrong fixed IV (keyBytes[:16]), non-PKCS7 padding (zero padding, ANSI X9.23), or truncated/modified ciphertext.

Common situations: Migrating payloads encrypted by other tools with different padding or IV conventions, key rotation on the producer side, or man-in-the-middle/corrupted storage flipping bytes in the final blocks.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/72ad0b20ef11125a. Report an issue: GitHub.