From f0db5d48ad0c61de32d46a45534057e2e6d03b2d Mon Sep 17 00:00:00 2001
From: ZacharyZcR <zacharyzcr1984@gmail.com>
Date: Sat, 9 May 2026 11:08:32 +0800
Subject: [PATCH] fix ms17010 legacy packet decoding (#574)

---
 plugins/services/ms17010.go      |  5 +----
 plugins/services/ms17010_test.go | 29 +++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/plugins/services/ms17010.go b/plugins/services/ms17010.go
index cbebbf9..7bba523 100644
--- a/plugins/services/ms17010.go
+++ b/plugins/services/ms17010.go
@@ -184,10 +184,7 @@ func aesDecrypt(crypted string, key string) (string, error) {
 		return "", fmt.Errorf("密文长度过短")
 	}
 
-	iv := cryptedBytes[:aes.BlockSize]
-	cryptedBytes = cryptedBytes[aes.BlockSize:]
-
-	mode := cipher.NewCBCDecrypter(block, iv)
+	mode := cipher.NewCBCDecrypter(block, keyBytes[:aes.BlockSize])
 	mode.CryptBlocks(cryptedBytes, cryptedBytes)
 
 	// 移除PKCS7填充
diff --git a/plugins/services/ms17010_test.go b/plugins/services/ms17010_test.go
index f2730e2..87847df 100644
--- a/plugins/services/ms17010_test.go
+++ b/plugins/services/ms17010_test.go
@@ -3,6 +3,7 @@
 package services
 
 import (
+	"bytes"
 	"context"
 	"net"
 	"testing"
@@ -11,6 +12,34 @@ import (
 	"github.com/shadow1ng/fscan/common"
 )
 
+func TestMS17010LegacyRequestsDecodeToSMB1Packets(t *testing.T) {
+	requests := map[string][]byte{
+		"negotiate":          negotiateProtocolRequest,
+		"sessionSetup":       sessionSetupRequest,
+		"treeConnect":        treeConnectRequest,
+		"transNamedPipe":     transNamedPipeRequest,
+		"trans2SessionSetup": trans2SessionSetupRequest,
+	}
+
+	for name, request := range requests {
+		t.Run(name, func(t *testing.T) {
+			if len(request) < 36 {
+				t.Fatalf("request length = %d, want at least 36", len(request))
+			}
+			if request[0] != 0x00 {
+				t.Fatalf("NetBIOS message type = 0x%02x, want 0x00", request[0])
+			}
+			payloadLen := int(request[1])<<16 | int(request[2])<<8 | int(request[3])
+			if payloadLen != len(request)-4 {
+				t.Fatalf("NetBIOS payload length = %d, want %d", payloadLen, len(request)-4)
+			}
+			if !bytes.Equal(request[4:8], []byte{0xff, 0x53, 0x4d, 0x42}) {
+				t.Fatalf("SMB signature = % x, want ff 53 4d 42", request[4:8])
+			}
+		})
+	}
+}
+
 func TestMS17010CheckDetectsVulnerableStatus(t *testing.T) {
 	addr, cleanup := startMS17010FakeServer(t, true, 45)
 	defer cleanup()