module

FreePBX 2.10.0 / 2.9.0 callmenum Remote Code Execution

Disclosed	Created
Mar 20, 2012	May 30, 2018

Disclosed

Mar 20, 2012

Created

May 30, 2018

Description

This module exploits FreePBX version 2.10.0,2.9.0 and possibly older.
Due to the way callme_page.php handles the 'callmenum' parameter, it
is possible to inject code to the '$channel' variable in function
callme_startcall in order to gain remote code execution.

Please note in order to use this module properly, you must know the
extension number, which can be enumerated or bruteforced, or you may
try some of the default extensions such as 0 or 200. Also, the call
has to be answered (or go to voice).

Tested on both Elastix and FreePBX ISO image installs.

Authors

muts
Martin Tschirsich

Platform

Unix

Architectures

cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/unix/http/freepbx_callmenum
    msf exploit(freepbx_callmenum) > show targets
        ...targets...
    msf exploit(freepbx_callmenum) > set TARGET < target-id >
    msf exploit(freepbx_callmenum) > show options
        ...show and set options...
    msf exploit(freepbx_callmenum) > exploit

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report