Hacking Exposed - VoIP - Voice Over IP Security Secrets & Solutions - Sample Chapter 3 - Enumerating a Network.pdf

(1360 KB) Pobierz

Hacking

/ Hacking Exposed VoIP: Voice Over IP Security Secrets & Solutions / Endler & Collier / 2263644

tin

IP N

ch03.indd 1

11/1/2006 8:27:10 PM

Hacking

/ Hacking Exposed VoIP: Voice Over IP Security Secrets & Solutions / Endler & Collier / 2263644

Hacking Exposed VoIP: Voice over IP Security Secrets & Solutions

It pays to be obvious, especially if you have a reputation for subtlety.

—Isaac Asimov

ow that the hacker has developed a list of active IP addresses and services in your

VoIP environment, the next logical step is to probe those services aggressively in

search of known weaknesses and vulnerabilities. This process is called

enumeration

and is more intrusive and noisy than the reconnaissance techniques we have covered so

far. In the last chapter, we compared scanning to a masterful art thief walking around the

Louvre checking for doors. Enumeration can best be compared to that same thief going

one step further and rattling door knobs loudly until he finds an unlocked one.

The goal of enumeration is to leverage the target’s open services to glean sensitive

information that can assist in launching further attacks. For example, an effective

enumeration technique covered in this chapter involves brute forcing VoIP PBXs and

phones in order to generate a list of valid phone extensions. Gleaning the phone

extensions that are active on a VoIP network is necessary for attacks such as INVITE

floods and REGISTER hijacking, which are covered in Chapters 12 and 13, respectively.

Enumerating common VoIP infrastructure support services, such as TFTP and SNMP,

can also often unearth a treasure trove of sensitive configuration information. As you

saw in the Google hacking exercise in Chapter 1, many VoIP phones come installed with

active web servers on them by default so that an administrator can easily configure them.

Unfortunately, these web interfaces can reveal very sensitive device and network

configuration details given the right enumeration techniques.

This chapter will discuss some of the enumeration techniques relevant to SIP-based

devices, as well as targeting the highly exposed VoIP support services such as TFTP,

SNMP, and others. The chapter begins, however, with review of SIP and RTP.

SIP 101

The majority of techniques covered in this chapter, and in the rest of this book, assume a

basic understanding of the

Session Initiation Protocol (SIP)

(http://www.cs.columbia

.edu/sip/). While it goes beyond the scope of this book to delve thoroughly into the

complete workings of SIP, it will be helpful to review some of the basics.

Simply put, SIP allows two speaking parties to set up, modify, and terminate a phone

call between the two of them. SIP is a text-based protocol and is most similar, at first

glance, to the HTTP protocol. SIP messages are composed of specific requests and

responses that are detailed here.

ch03.indd 2

11/1/2006 8:27:30 PM

Hacking

/ Hacking Exposed VoIP: Voice Over IP Security Secrets & Solutions / Endler & Collier / 2263644

Chapter 3:

Enumerating a VoIP Network

SIP URIs

A SIP

Uniform Resource Indicator (URI)

is how users are addressed in the SIP world (RFC

3261). The general format of a SIP URI is

sip:user:password@host:port;uri-parameters?headers

Some example SIP URIs taken directly from the RFC are

sip:alice@atlanta.com

sip:2125551212@example.com

sip:alice:secretword@atlanta.com;transport=tcp

sip:+1-212-555-1212:1234@gateway.com;user=phone

sip:alice@192.0.2.4:5060

sip:atlanta.com;method=REGISTER?to=alice%40atlanta.com

sip:alice;day=tuesday@atlanta.com

SIP Architecture Elements

There are five logical core components in SIP architecture. Many of the server functions

detailed here are often consolidated into one or two server applications.

•

User agents (UA)

Any client application or device that initiates a SIP

connection, such as an IP phone, PC softphone, PC instant messaging client, or

mobile device. The user agent can also be a gateway that interacts with the PSTN.

•

Proxy server

A proxy server is a server that receives SIP requests from various

user agents and routes them to the appropriate next hop. A typical call traverses

at least two proxies before reaching the intended callee.

•

Redirect server

Sometimes it is better to ofﬂoad the processing load on proxy

servers by introducing a redirect server. A redirect server directs incoming

requests from other clients to contact an alternate set of URIs.

•

Registrar server

A server that processes REGISTER requests. The registrar

processes REGISTER requests from users and maps their SIP URI to their

current location (IP address, username, port, and so on). For instance,

sip:dave@hackingexposed.com might be mapped to something like sip:

dave@192.168.1.100:5060, which is the softphone from which I just registered.

•

Location server

The location server is used by a redirect server or a proxy

server to ﬁnd the callee’s possible location. This function is most often

performed by the registrar server.

A typical SIP-based call flow is best represented by the illustration in the section,

“Typical Call Flow,” later in this chapter.

ch03.indd 3

11/1/2006 8:27:30 PM

Hacking

/ Hacking Exposed VoIP: Voice Over IP Security Secrets & Solutions / Endler & Collier / 2263644

Hacking Exposed VoIP: Voice over IP Security Secrets & Solutions

SIP Requests

SIP requests can be used in a standalone sense or in a dialog with other SIP requests and

responses. The following is a brief overview of the most common requests used in call

initiation and teardown:

SIP Request

INVITE

BYE

OPTIONS

ACK

CANCEL

Purpose

Initiates a conversation.

Terminates an existing connection between two

users in a session.

Determines the SIP messages and codecs that the

UA or server understands.

Registers a location from a SIP user.

Acknowledges a response from an INVITE request.

Cancels a pending INVITE request, but does not

affect a completed request (for instance, stops the

call setup if the phone is still ringing).

Transfers calls and contacts external resources.

Indicates the desire for future NOTIFY requests.

Provides information about a state change that

is not related to a speciﬁc session. (For example,

Windows Messenger uses a SUBSCRIBE method to

get contacts, groups, and allow and block lists from

the server. Microsoft Live Communications Server

2003 uses a NOTIFY to transfer this information.)

RFC Reference

RFC 3261

REFER

NOTIFY

RFC 3515

RFC 3265

SIP Responses

SIP responses (RFC 2543) are three-digit codes much like HTTP (for example, 200 OK,

404 Not Found, and so on). The first digit indicates the category of the response. The

entire range of possible responses to a SIP request is as follows:

Response

1xx responses

Plik z chomika:

WMatrixie

Hacking Exposed - VoIP - Voice Over IP Security Secrets & Solutions - Sample Chapter 3 - Enumerating a Network.pdf

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: