1*7f2fe78bSCy Schubertimport socket 2*7f2fe78bSCy Schubertfrom k5test import * 3*7f2fe78bSCy Schubert 4*7f2fe78bSCy Schubertrealm = K5Realm() 5*7f2fe78bSCy Schubert 6*7f2fe78bSCy Schubert# CVE-2021-36222 KDC null dereference on encrypted challenge preauth 7*7f2fe78bSCy Schubert# without FAST 8*7f2fe78bSCy Schubert 9*7f2fe78bSCy Schuberts = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) 10*7f2fe78bSCy Schuberta = (hostname, realm.portbase) 11*7f2fe78bSCy Schubert 12*7f2fe78bSCy Schubertm = ('6A81A0' '30819D' # [APPLICATION 10] SEQUENCE 13*7f2fe78bSCy Schubert 'A103' '0201' '05' # [1] pvno = 5 14*7f2fe78bSCy Schubert 'A203' '0201' '0A' # [2] msg-type = 10 15*7f2fe78bSCy Schubert 'A30E' '300C' # [3] padata = SEQUENCE OF 16*7f2fe78bSCy Schubert '300A' # SEQUENCE 17*7f2fe78bSCy Schubert 'A104' '0202' '008A' # [1] padata-type = PA-ENCRYPTED-CHALLENGE 18*7f2fe78bSCy Schubert 'A202' '0400' # [2] padata-value = "" 19*7f2fe78bSCy Schubert 'A48180' '307E' # [4] req-body = SEQUENCE 20*7f2fe78bSCy Schubert 'A007' '0305' '0000000000' # [0] kdc-options = 0 21*7f2fe78bSCy Schubert 'A120' '301E' # [1] cname = SEQUENCE 22*7f2fe78bSCy Schubert 'A003' '0201' '01' # [0] name-type = NT-PRINCIPAL 23*7f2fe78bSCy Schubert 'A117' '3015' # [1] name-string = SEQUENCE-OF 24*7f2fe78bSCy Schubert '1B06' '6B7262746774' # krbtgt 25*7f2fe78bSCy Schubert '1B0B' '4B5242544553542E434F4D' 26*7f2fe78bSCy Schubert # KRBTEST.COM 27*7f2fe78bSCy Schubert 'A20D' '1B0B' '4B5242544553542E434F4D' 28*7f2fe78bSCy Schubert # [2] realm = KRBTEST.COM 29*7f2fe78bSCy Schubert 'A320' '301E' # [3] sname = SEQUENCE 30*7f2fe78bSCy Schubert 'A003' '0201' '01' # [0] name-type = NT-PRINCIPAL 31*7f2fe78bSCy Schubert 'A117' '3015' # [1] name-string = SEQUENCE-OF 32*7f2fe78bSCy Schubert '1B06' '6B7262746774' # krbtgt 33*7f2fe78bSCy Schubert '1B0B' '4B5242544553542E434F4D' 34*7f2fe78bSCy Schubert # KRBTEST.COM 35*7f2fe78bSCy Schubert 'A511' '180F' '31393934303631303036303331375A' 36*7f2fe78bSCy Schubert # [5] till = 19940610060317Z 37*7f2fe78bSCy Schubert 'A703' '0201' '00' # [7] nonce = 0 38*7f2fe78bSCy Schubert 'A808' '3006' # [8] etype = SEQUENCE OF 39*7f2fe78bSCy Schubert '020112' '020111') # aes256-cts aes128-cts 40*7f2fe78bSCy Schubert 41*7f2fe78bSCy Schuberts.sendto(bytes.fromhex(m), a) 42*7f2fe78bSCy Schubert 43*7f2fe78bSCy Schubert# Make sure kinit still works. 44*7f2fe78bSCy Schubertrealm.kinit(realm.user_princ, password('user')) 45*7f2fe78bSCy Schubert 46*7f2fe78bSCy Schubertsuccess('CVE-2021-36222 regression test') 47