VoIP
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 4000 192.168.152.156
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-06 15:06 +08
Nmap scan report for 192.168.152.156
Host is up (0.17s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
8000/tcp open http-altInitial Enumeration -> Digest Leak
Port 80 had a login page:
We didn't have any credentials, and weak credentials don't work, so we can move on first.
Port 8000 had another login page:
admin:admin worked for this one, and we were brought to a IP Phone instance, which matches the name of the box being Voice over IP:
Within the logs tab, we can see that there were some calls being logged:
Within the Configuration tab, there was some XML looking output. Here's it below:
The only thing notable about this was teh protocl used, which was SIP/2.0. Since we know that SIP is being used, we can test for stuff on Hacktricks like SIPDigestLeak from the sippts repo:
Using this worked and we managed to get a hashed password:
This hash cracks easily:
With this, we can login to port 80 as adm_sip.
Audio File -> SSH Creds
We can view the CDR (Call Data Records) and find that one of them is raw, which allows us to download it:
This is a raw audio file, and we need to convert it using sox. We can find the exact configurations required in the Stream Rates tab on the left:
Then, we can convert this to a wav file:
Afterwards, we can listen to the audio file and it just plays this one line.
Interesting. We have a username, but not a password. This was the part I got stuck at for a long time. I tried some usernames like voip, zoiper, and voiper because those were popular softwares used with VoIP, and voiper worked:
Privilege Escalation
This was simple:
Rooted!
Last updated