119 lines
2.7 KiB
Ruby
119 lines
2.7 KiB
Ruby
require 'rex/proto/iax2/client'
|
|
|
|
module Msf
|
|
|
|
###
|
|
#
|
|
# This module provides methods for working with the IAX2 protocol
|
|
#
|
|
###
|
|
module Auxiliary::IAX2
|
|
|
|
#
|
|
# Initializes an instance of an auxiliary module that uses IAX2
|
|
#
|
|
|
|
def initialize(info = {})
|
|
super
|
|
|
|
register_options(
|
|
[
|
|
OptAddress.new('IAX_HOST', [true, 'The IAX2 server to communicate with']),
|
|
OptPort.new('IAX_PORT', [true, 'The IAX2 server port', 4569]),
|
|
OptString.new('IAX_USER', [false, 'An optional IAX2 username']),
|
|
OptString.new('IAX_PASS', [false, 'An optional IAX2 password']),
|
|
OptString.new('IAX_CID_NAME', [false, 'The default caller ID name', '']),
|
|
OptString.new('IAX_CID_NUMBER', [true, 'The default caller ID number', '15555555555'])
|
|
], Msf::Auxiliary::IAX2 )
|
|
|
|
register_advanced_options(
|
|
[
|
|
OptBool.new('IAX_DEBUG', [false, 'Enable IAX2 debugging messages', false])
|
|
], Msf::Auxiliary::IAX2 )
|
|
|
|
end
|
|
|
|
def connect
|
|
@iax.shutdown if @iax
|
|
@iax = Rex::Proto::IAX2::Client.new(
|
|
:server_host => datastore['IAX_HOST'],
|
|
:username => datastore['IAX_USER'],
|
|
:password => datastore['IAX_PASS'],
|
|
:caller_name => datastore['IAX_CID_NAME'],
|
|
:caller_number => datastore['IAX_CID_NUMBER'],
|
|
:debugging => datastore['IAX_DEBUG'],
|
|
:context => {
|
|
'Msf' => framework,
|
|
'MsfExploit' => self
|
|
}
|
|
)
|
|
@iax_reg = @iax.create_call()
|
|
r = @iax_reg.register
|
|
if not r
|
|
@iax.shutdown
|
|
@iax = nil
|
|
raise RuntimeError, "Failed to register with the server"
|
|
end
|
|
end
|
|
|
|
def create_call
|
|
if not @iax
|
|
raise RuntimeError, "No active IAX2 connection"
|
|
end
|
|
@iax.create_call
|
|
end
|
|
|
|
def cleanup
|
|
super
|
|
@iax.shutdown if @iax
|
|
end
|
|
|
|
# General purpose phone number mangling routines
|
|
# Convert 123456XXXX to an array of expanded numbers
|
|
def crack_phone_range(range)
|
|
crack_phone_ranges([range])
|
|
end
|
|
|
|
def crack_phone_ranges(masks)
|
|
res = {}
|
|
masks.each do |mask|
|
|
mask = mask.strip
|
|
|
|
if(mask.index(':'))
|
|
next if mask.index('X')
|
|
rbeg,rend = mask.split(':').map{|c| c.gsub(/[^\d]/, '').to_i }
|
|
rbeg.upto(rend) do |n|
|
|
res[n.to_s] = {}
|
|
end
|
|
next
|
|
end
|
|
|
|
incdigits = 0
|
|
mask.each_char do |c|
|
|
incdigits += 1 if c =~ /^[X#]$/i
|
|
end
|
|
|
|
max = (10**incdigits)-1
|
|
|
|
(0..max).each do |num|
|
|
number = mask.dup # copy the mask
|
|
numstr = sprintf("%0#{incdigits}d", num) # stringify our incrementing number
|
|
j = 0 # index for numstr
|
|
for i in 0..number.length-1 do # step through the number (mask)
|
|
if number[i].chr =~ /^[X#]$/i
|
|
number[i] = numstr[j] # replaced masked indexes with digits from incrementing number
|
|
j += 1
|
|
end
|
|
end
|
|
res[number] = {}
|
|
end
|
|
|
|
end
|
|
|
|
return res.keys.sort
|
|
end
|
|
|
|
end
|
|
end
|
|
|