Hunting PBX For Vulnerabilities Sachin Wagh Security Analyst - - PowerPoint PPT Presentation

▶
hunting pbx for vulnerabilities sachin wagh
SMART_READER_LITE
LIVE PREVIEW

Hunting PBX For Vulnerabilities Sachin Wagh Security Analyst - - PowerPoint PPT Presentation

Dec 31, 2023 416 likes •804 views

Hunting PBX For Vulnerabilities Sachin Wagh Security Analyst Security Intelligence Team @ Symantec Speaker at Hakon and Geek Street - Infosecurity Europe Bug Hunter | Penetration Tester Security Blogger @tiger_tigerboy

slide-1
SLIDE 1

Hunting PBX For Vulnerabilities

slide-2
SLIDE 2

Sachin Wagh

Security Analyst

 Security Intelligence Team @ Symantec  Speaker at Hakon and Geek Street - Infosecurity Europe  Bug Hunter | Penetration Tester  Security Blogger @tiger_tigerboy

slide-3
SLIDE 3

Himanshu Mehta

Senior Threat Analysis Engineer

 Security Intelligence Team @ Symantec  Speaker at National Cyber Security Conference, Hakon & Geek Street - Infosecurity Europe  Advisory Board Member @EC-Council & Convetit  Bug Hunter | Penetration Tester @LionHeartRoxx

slide-4
SLIDE 4

Content

  • What is PBX
  • Features
  • Searching
  • Softphone
  • Vulnerabilities
  • Mitigations

Hunting PBX for Vulnerabilities

slide-5
SLIDE 5

Private Branch Exchange

Hunting PBX for Vulnerabilities

Source: http://www.cealcomz.co.za

slide-6
SLIDE 6

Features

Hunting PBX for Vulnerabilities

  • Call Forwarding
  • Call Transfer
  • Conference Calls
  • Automatic Call Delivery (ACD)
  • Voice Messaging
  • Call Queue ..etc
slide-7
SLIDE 7

Searching

Hunting PBX for Vulnerabilities

slide-8
SLIDE 8

Shodan:

Hunting PBX for Vulnerabilities

"NCH Software Axon Virtual PBX“

slide-9
SLIDE 9

Call Details Records

Hunting PBX for Vulnerabilities

slide-10
SLIDE 10

Censys:

Hunting PBX for Vulnerabilities

"FreePBX Administration“

slide-11
SLIDE 11

Censys:

Hunting PBX for Vulnerabilities

"FreePBX Administration“

slide-12
SLIDE 12

Hunting PBX for Vulnerabilities

slide-13
SLIDE 13

Shodan:

Hunting PBX for Vulnerabilities

“polycom+command+shell“

slide-14
SLIDE 14

File Transfer Protocol (FTP)

Hunting PBX for Vulnerabilities

slide-15
SLIDE 15

Call Details Records

Hunting PBX for Vulnerabilities

slide-16
SLIDE 16

Server Message Block (smb)

Hunting PBX for Vulnerabilities

slide-17
SLIDE 17

Server Message Block (smb)

Hunting PBX for Vulnerabilities

slide-18
SLIDE 18

Shodan:

Hunting PBX for Vulnerabilities

“port:23 console gateway -password“

slide-19
SLIDE 19

Softphone

Hunting PBX for Vulnerabilities

slide-20
SLIDE 20

Vulnerabilities

Hunting PBX for Vulnerabilities

slide-21
SLIDE 21

TRIXBOX

Hunting PBX for Vulnerabilities

slide-22
SLIDE 22

Blind OS Command Injection

Hunting PBX for Vulnerabilities

I AM NOT BLIND I’VE JUST SEEN ENOUGH

slide-23
SLIDE 23

Hunting PBX for Vulnerabilities

slide-24
SLIDE 24

Blind OS Command Injection [DEMO]

Hunting PBX for Vulnerabilities

CVE-2017-14535

slide-25
SLIDE 25

Path Traversal

Hunting PBX for Vulnerabilities

slide-26
SLIDE 26

Hunting PBX for Vulnerabilities

Path Traversal [DEMO]

CVE-2017-14537

slide-27
SLIDE 27

Hunting PBX for Vulnerabilities

Path Traversal [DEMO]

CVE-2017-14537

slide-28
SLIDE 28

Cross-site Scripting

Hunting PBX for Vulnerabilities

source:gif-finder.com
slide-29
SLIDE 29

Hunting PBX for Vulnerabilities

Cross-site Scripting [DEMO]

CVE-2017-14536

slide-30
SLIDE 30

AXON

Hunting PBX for Vulnerabilities

slide-31
SLIDE 31

Hunting PBX for Vulnerabilities

Cross-site Scripting [DEMO]

CVE-2018-11552

slide-32
SLIDE 32

Local Code Execution

Hunting PBX for Vulnerabilities

slide-33
SLIDE 33

Hunting PBX for Vulnerabilities

Local Code Execution [DEMO]

CVE-2018-11551

slide-34
SLIDE 34

Hunting PBX for Vulnerabilities

slide-35
SLIDE 35

Hunting PBX for Vulnerabilities

Local Code Execution [DEMO]

CVE-2018-11551

slide-36
SLIDE 36

Hunting PBX for Vulnerabilities

slide-37
SLIDE 37

Mitigations

 POLICIES AND PROCEDURES :  SECURITY TRAINING  PASSWORD POLICY  INCIDENT RESPONSE PROCEDURE  OS LEVEL SECURITY :  PATCHES  APPLICATIONS AND SERVICES  PRIVILEGES

Hunting PBX for Vulnerabilities

slide-38
SLIDE 38

Thank You

Hunting PBX for Vulnerabilities