CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'metasploit/framework/credential_collection'
7
require 'metasploit/framework/login_scanner/freeswitch_event_socket'
8

9
class MetasploitModule < Msf::Auxiliary
10
  include Msf::Exploit::Remote::Tcp
11
  include Msf::Auxiliary::Scanner
12
  include Msf::Auxiliary::Report
13
  include Msf::Auxiliary::AuthBrute
14
  prepend Msf::Exploit::Remote::AutoCheck
15

16
  def initialize(info = {})
17
    super(
18
      update_info(
19
        info,
20
        'Name' => 'FreeSWITCH Event Socket Login',
21
        'Description' => %q{
22
          This module tests FreeSWITCH Event Socket logins on a range of
23
          machines and report successful attempts.
24
        },
25
        'Author' => [
26
          'krastanoel'
27
        ],
28
        'References' => [
29
          ['URL', 'https://freeswitch.org/confluence/display/FREESWITCH/mod_event_socket']
30
        ],
31
        'DefaultOptions' => { 'VERBOSE' => false },
32
        'License' => MSF_LICENSE,
33
        'Notes' => {
34
          'Stability' => [CRASH_SERVICE_RESTARTS],
35
          'Reliability' => [],
36
          'SideEffects' => []
37
        }
38
      )
39
    )
40

41
    register_options(
42
      [
43
        Opt::RPORT(8021),
44
        OptString.new('PASSWORD', [false, 'FreeSWITCH event socket default password', 'ClueCon']),
45
        OptPath.new('PASS_FILE',
46
                    [
47
                      false,
48
                      'The file that contains a list of of probable passwords.',
49
                      File.join(Msf::Config.install_root, 'data', 'wordlists', 'unix_passwords.txt')
50
                    ])
51
      ]
52
    )
53

54
    # freeswitch does not have an username, there's only password
55
    deregister_options(
56
      'DB_ALL_CREDS', 'DB_ALL_USERS', 'DB_SKIP_EXISTING', 'BLANK_PASSWORDS',
57
      'USERNAME', 'USER_AS_PASS', 'USERPASS_FILE', 'USER_FILE',
58
      'STOP_ON_SUCCESS'
59
    )
60
  end
61

62
  def run_host(ip)
63
    cred_collection = Metasploit::Framework::PrivateCredentialCollection.new(
64
      password: datastore['PASSWORD'],
65
      pass_file: datastore['PASS_FILE']
66
    )
67
    cred_collection = prepend_db_passwords(cred_collection)
68

69
    scanner = Metasploit::Framework::LoginScanner::FreeswitchEventSocket.new(
70
      configure_login_scanner(
71
        host: ip,
72
        port: rport,
73
        cred_details: cred_collection,
74
        stop_on_success: true, # this will have no effect due to the scanner behaviour when scanning without username
75
        connection_timeout: 10
76
      )
77
    )
78

79
    scanner.scan! do |result|
80
      credential_data = result.to_h
81
      credential_data.merge!(
82
        module_fullname: fullname,
83
        workspace_id: myworkspace_id
84
      )
85

86
      if result.success?
87
        credential_data.delete(:username) # This service uses no username
88
        credential_core = create_credential(credential_data)
89
        credential_data[:core] = credential_core
90
        create_credential_login(credential_data)
91

92
        if datastore['VERBOSE']
93
          vprint_good("Login Successful: #{result.credential.private} (#{result.status}: #{result.proof&.strip})")
94
        else
95
          print_good("Login Successful: #{result.credential.private}")
96
        end
97
      else
98
        invalidate_login(credential_data)
99
        vprint_error("LOGIN FAILED: #{result.credential.private} (#{result.status}: #{result.proof&.strip})")
100
      end
101
    end
102
  end
103

104
  def check_host(_ip)
105
    connect
106
    banner = sock.get
107
    disconnect(sock)
108

109
    if banner.include?('Access Denied, go away.') || banner.include?('text/rude-rejection')
110
      return Exploit::CheckCode::Safe('Access denied by network ACL')
111
    end
112

113
    unless banner.include?('Content-Type: auth/request')
114
      return Exploit::CheckCode::Unknown('Unable to determine the service fingerprint')
115
    end
116

117
    return Exploit::CheckCode::Appears
118
  end
119
end
120

121