The Apple Filing Protocol serves macOS file sharing and Time Machine backups, usually on port 548, most often through the open-source Netatalk server on Linux and NAS devices. Offensive interest is reaching shares without proper credentials (guest access, defaults) and exploiting Netatalk, which has a history of unauthenticated remote code execution.
Subtopics#
- Guest access: anonymous mounting and share listing.
- Default credentials: weak and shipped credentials.
- Netatalk exploits: named RCE in the AFP server.