From 3bf1cb0376ada984e37c50c010eecde96b889c80 Mon Sep 17 00:00:00 2001
From: ZacharyZcR <zacharyzcr1984@gmail.com>
Date: Mon, 27 Apr 2026 19:19:53 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=20Web=20Stop=20?=
 =?UTF-8?q?=E4=BF=A1=E5=8F=B7=E7=AD=89=E5=BE=85=E9=98=BB=E5=A1=9E=E5=92=8C?=
 =?UTF-8?q?=20SMB=20=E5=93=8D=E5=BA=94=E8=A7=A3=E6=9E=90=E8=B6=8A=E7=95=8C?=
 =?UTF-8?q?=20panic?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- scanner.go: 长驻插件等待信号时同时监听 ctx.Done()，Web Stop 可正常返回
- smb_protocol.go: 响应长度检查修正为 47，远端偏移量全部做边界校验
---
 core/scanner.go                  |  9 ++++++---
 plugins/services/smb_protocol.go | 21 +++++++++++++--------
 2 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/core/scanner.go b/core/scanner.go
index e19c17d..fb25133 100644
--- a/core/scanner.go
+++ b/core/scanner.go
@@ -109,11 +109,14 @@ func RunScan(ctx context.Context, info common.HostInfo, config *common.Config, s
 		}
 		common.LogInfo(i18n.GetText("press_ctrl_c_exit"))
 
-		// 优雅等待信号
+		// 优雅等待信号或 context 取消（Web Stop）
 		sigChan := make(chan os.Signal, 1)
 		signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)
-		<-sigChan
-		common.LogInfo(i18n.GetText("received_exit_signal"))
+		select {
+		case <-sigChan:
+			common.LogInfo(i18n.GetText("received_exit_signal"))
+		case <-ctx.Done():
+		}
 		cancel()
 		time.Sleep(500 * time.Millisecond)
 	}
diff --git a/plugins/services/smb_protocol.go b/plugins/services/smb_protocol.go
index 4ff749e..2f0e96c 100644
--- a/plugins/services/smb_protocol.go
+++ b/plugins/services/smb_protocol.go
@@ -242,7 +242,7 @@ func probeSMBv1(conn net.Conn, target string, timeout time.Duration) (*SMBTarget
 	}
 
 	ret, err := readSMBMessage(conn)
-	if err != nil || len(ret) < 45 {
+	if err != nil || len(ret) < 47 {
 		return nil, fmt.Errorf("读取SMBv1 Session Setup响应失败: %w", err)
 	}
 
@@ -251,21 +251,24 @@ func probeSMBv1(conn net.Conn, target string, timeout time.Duration) (*SMBTarget
 	}
 
 	// 解析blob信息
-	blobLength := bytesToUint16(ret[43:45])
-	blobCount := bytesToUint16(ret[45:47])
+	blobLength := int(bytesToUint16(ret[43:45]))
+	blobCount := int(bytesToUint16(ret[45:47]))
 
-	if int(blobCount) > len(ret) {
+	gssNative := ret[47:]
+	gssLen := len(gssNative)
+
+	// 校验远端返回的偏移量
+	if blobLength > gssLen || blobCount > gssLen || blobLength > blobCount {
 		return info, nil
 	}
 
-	gssNative := ret[47:]
 	offNTLM := bytes.Index(gssNative, []byte("NTLMSSP"))
 	if offNTLM == -1 {
 		return info, nil
 	}
 
 	// 提取native OS和LM信息
-	native := gssNative[int(blobLength):blobCount]
+	native := gssNative[blobLength:blobCount]
 	ss := strings.Split(string(native), "\x00\x00")
 
 	if len(ss) > 0 {
@@ -276,8 +279,10 @@ func probeSMBv1(conn net.Conn, target string, timeout time.Duration) (*SMBTarget
 	}
 
 	// 解析NTLM信息
-	bs := gssNative[offNTLM:blobLength]
-	parseNTLMChallenge(bs, info)
+	if offNTLM <= blobLength {
+		bs := gssNative[offNTLM:blobLength]
+		parseNTLMChallenge(bs, info)
+	}
 
 	return info, nil
 }