AFP (Apple Filing Protocol) serves Apple-style file shares on TCP 548. It was macOS's native file sharing before SMB took over, and it persists on older macOS servers, Time Machine targets, and especially on NAS appliances and Linux servers running Netatalk, the open-source AFP implementation. Offensively there are three threads: guest access, which many AFP servers enable by default and which exposes volumes without credentials; default and weak credentials on appliances; and Netatalk's implementation, which has carried several serious pre-authentication remote code execution bugs that make an exposed Netatalk a direct compromise target.
# discover AFP and enumerate server info/volumes
nmap -p548 --script afp-serverinfo,afp-showmount,afp-ls <target>
# afp-serverinfo reveals the server name, version, and supported auth (incl. "No User Authent" = guest)
Subtopics#
- Guest access: unauthenticated access to AFP volumes.
- Default credentials: weak and vendor-default accounts on appliances.
- Netatalk exploits: the implementation's pre-auth RCE history.