VoIP Spoofing (Intigriti) 1,250€

Hello Folks, i just want to explain a misconfiguration that affect an asset on Intigriti. So, let’s start!!

VoIP implementation allows audio calls to be made using an Internet connection instead of a conventional phone. Some VoIP gateway partners may allow you to call others who have a phone number, including local, long distance, mobile, and international numbers.

VoIP uses 5060 as a SIP signaling port by default. Used to register the phone (for example, Cisco, Polycom, etc.)

Among the most important features of VoIP are:

- Use of multiple lines

- Voicemail service

- Voice recording

- Call log

- Modular configurations

Session Initiation Protocol (SIP) allows users to establish communications, terminate, or modify voice or video calls. According to pentesting experts, voice or video traffic is transmitted via Real-Time Protocol (RTP). SIP is an application layer protocol that uses UDP or TCP for traffic. By default, SIP uses UDP/TCP port 5060.

Realize that your target is 182.x.x.x/27, so i started using nmap and i started to scan the subnet, i just found an interesting IP that have the port 5060 open:

first at all i used wireshark for take listen of this port and i found some username like:

Actually, i got so many usernames, and i can actually listen,register, delete, or spoof their call but how?

Let’s try to send an HIT request with a “Test” Username using inviteflood

As you can see i already sent call to the user “102” with a Test as username, let’s open wireshark and filter for SIP and see what happen:

As we can see i can invite to call any of their agents, using a VoIP spoofing, Currently, someone’s cell phone is ringing, and as you can see i Invite someone in their internal network IP start with 10.x.x.x . Now Let’s analyze that invite call.

Ok as you can see i can NOTIFY, REFER, INVITE,ACK, CANCEL, BYE option. So i can CANCEL some outgoing call, i can LISTEN or Register inside call or spoof it.

This misconfiguration is marked as HIGH from the company and they rewarded me 1,250 EUR.

Marked High:

Thank guys for reading, and Happy bug hunting!