text: import socket
  from k5test import *
  
  realm = K5Realm()
  
  # CVE-2021-36222 KDC null dereference on encrypted challenge preauth
  # without FAST
  
  s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
  a = (hostname, realm.portbase)
  
  m = ('6A81A0' '30819D'          # [APPLICATION 10] SEQUENCE
       'A103' '0201' '05'         #  [1] pvno = 5
       'A203' '0201' '0A'         #  [2] msg-type = 10
       'A30E' '300C'              #  [3] padata = SEQUENCE OF
       '300A'                     #   SEQUENCE
       'A104' '0202' '008A'       #    [1] padata-type = PA-ENCRYPTED-CHALLENGE
       'A202' '0400'              #    [2] padata-value = ""
       'A48180' '307E'            #  [4] req-body = SEQUENCE
       'A007' '0305' '0000000000' #   [0] kdc-options = 0
       'A120' '301E'              #   [1] cname = SEQUENCE
       'A003' '0201' '01'         #    [0] name-type = NT-PRINCIPAL
       'A117' '3015'              #    [1] name-string = SEQUENCE-OF
       '1B06' '6B7262746774'      #     krbtgt
       '1B0B' '4B5242544553542E434F4D'
                                  #     KRBTEST.COM
       'A20D' '1B0B' '4B5242544553542E434F4D'
                                  #   [2] realm = KRBTEST.COM
       'A320' '301E'              #   [3] sname = SEQUENCE
       'A003' '0201' '01'         #    [0] name-type = NT-PRINCIPAL
       'A117' '3015'              #    [1] name-string = SEQUENCE-OF
       '1B06' '6B7262746774'      #     krbtgt
       '1B0B' '4B5242544553542E434F4D'
                                  #     KRBTEST.COM
       'A511' '180F' '31393934303631303036303331375A'
                                  #   [5] till = 19940610060317Z
       'A703' '0201' '00'         #   [7] nonce = 0
       'A808' '3006'              #   [8] etype = SEQUENCE OF
       '020112' '020111')         #    aes256-cts aes128-cts
  
  s.sendto(bytes.fromhex(m), a)
  
  # Make sure kinit still works.
  realm.kinit(realm.user_princ, password('user'))
  
  success('CVE-2021-36222 regression test')
  