Open
Description
option_tcp seems to be fine:
msf5 auxiliary(scanner/sip/options_tcp) > run
[*] 2.2.2.2:5060 - 2.2.2.2:5060 tcp SIP/2.0 200 OK: {"Server"=>"Cisco-SIPGateway/IOS-12.x", "Allow"=>"INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, $
[*] 2.2.2.2:5060 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
but I don't get any UDP love:
msf5 auxiliary(scanner/sip/options) > run
[*] Sending SIP UDP OPTIONS requests to 2.2.2.2 ->2.2.2.2 (1 hosts)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
I can verify the service is good via nmap:
nmap --script=sip-methods -sU -p 5060 2.2.2.2
Starting Nmap 7.70 ( https://nmap.org ) at 2018-10-11 15:50 EDT
Nmap scan report for 2.2.2.2
Host is up (0.0035s latency).
PORT STATE SERVICE
5060/udp open sip
|_sip-methods: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER
Loaded up wireshark. Request goes out fine:
OPTIONS sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 1.1.1.1:5060;branch=z9hG4bK.ae2be03f;rport;alias
From: sip:[email protected]:5060;tag=70c00e8c
To: sip:[email protected]
Call-ID: [email protected]
CSeq: 1 OPTIONS
Contact: sip:[email protected]:5060
Max-Forwards: 20
User-Agent: Vkzf
Accept: application/sdp
Content-Length: 0
Response comes back:
SIP/2.0 200 OK
Via: SIP/2.0/UDP 1.1.1.1:5060;branch=z9hG4bK.ae2be03f;rport;alias
From: sip:[email protected]:5060;tag=70c00e8c
To: sip:[email protected];tag=14697EA4-1400
Date: Fri, 07 Jan 2000 19:48:21 GMT
Call-ID: [email protected]
Server: Cisco-SIPGateway/IOS-12.x
CSeq: 1 OPTIONS
Supported: 100rel,resource-priority,replaces
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER
Allow-Events: telephone-event
Accept: application/sdp
Content-Type: application/sdp
Content-Length: 172
v=0
o=CiscoSystemsSIP-GW-UserAgent 4302 4092 IN IP4 2.2.2.2
s=SIP Call
c=IN IP4 2.2.2.2
t=0 0
m=audio 0 RTP/AVP 18 0 8 9 4 2 15 3
c=IN IP4 2.2.2.2
however it doesn't seem to process. I added a hook to see if it was the response was coming back and not being caught, or a processing bug... never got any output so it looks like its a pre-sip response processor issue.
def scanner_process(data, shost, _)
print_good(data.to_s)
report_response(data, shost, 'udp')
end