# perl
# --------------------------------------------------------
# LICENCE
# This software is under GNU GENERAL PUBLIC LICENSE
# The detail could be found in the file LICENCE include
# in the same directory than isme.pl
# --------------------------------------------------------

use threads;
use threads::shared;
use Tk; # http://search.cpan.org/~srezic/Tk/pod/UserGuide.pod
use Tk::Radiobutton;
use Tk::PNG;
use LWP::UserAgent;
use HTTP::Request;
use Net::Ping; # http://search.cpan.org/~smpeters/Net-Ping-2.36/lib/Net/Ping.pm
use Net::Netmask; # http://search.cpan.org/dist/Net-Netmask/
use Net::Subnets;

# Declaring functions for network analyzing stuff. Thus no argument passing for function. Its all full available variable.
$p=Net::Ping->new("icmp");

# Variable
my $IpAddress = "";
my $Phone_number = "";
my $results = "";
my $Stop = 0;

my $subweb_mw = MainWindow->new(
						-title => 'SNOM VoIP Phone Remote Call Place and Remote Tap');

my $menu_bar = $subweb_mw->Frame(
				-relief => 'groove',
				-borderwidth => 3,
				-width => 40,
				)-> pack(
					-side=>'top',
					-fill => 'x'
					);
my $file_mb = $menu_bar->Menubutton(
				-text => 'File',
				)->pack(-side=>'left');
$file_mb->command(
			-label=>"Vulnerability details",
			-command => sub {&EXPLANATION}
			);
					
$file_mb->command(
			-label=>'Launch exploit',
			-command => sub {&LAUNCHEXPLOIT}
			);

$file_mb->command(
			-label=>"Save results",
			-command => sub {&SAVERESULTS}
			);
			
$file_mb->command(
	-label=>'Exit',
	-command => [$subweb_mw => 'destroy']
	);
		


#----------	
my $FrameMIDDLE1 = $subweb_mw -> Frame ();

$FrameMIDDLE1->Label(
	-text => 'Enter phone\'s IP address (192.168.1.1):  '
	)->pack(-side => 'left');
my $TextLabel = $FrameMIDDLE1 -> Entry(
	-textvariable => \$IP_Address,
	- width => 45,
	)->pack(-side => 'left');
$FrameMIDDLE1 -> pack (-side => 'top', -anchor => 'w');

#----------	
my $FrameMIDDLE2 = $subweb_mw -> Frame ();

$FrameMIDDLE2->Label(
	-text => 'Enter phone number to call:                    '
	)->pack(-side => 'left');
my $TextLabel = $FrameMIDDLE2 -> Entry(
	-textvariable => \$Phone_number,
	- width => 45,
	)->pack(-side => 'left');
$FrameMIDDLE2 -> pack (-side => 'top', -anchor => 'w');


#-------------
my $FrameMIDDLE4 = $subweb_mw -> Frame (-width => 40, -height => 20);

my $TextWidget = $FrameMIDDLE4  -> Text(); 
$TextWidget->configure(-height => 33);
my $scrollbar = $FrameMIDDLE4 ->Scrollbar(-command => ['yview', $TextWidget]);
$TextWidget->configure(-yscrollcommand => ['set', $scrollbar]);

$TextWidget->pack(-side => 'left', -fill => 'both', -expand => 1);
$scrollbar->pack(-side => 'right', -fill => 'y');
$FrameMIDDLE4 -> pack (-side => 'top', -anchor => 'w');
#-------------
#my $FrameMIDDLE5 = $subweb_mw -> Frame (-width => 40, -height => 15);
#$FrameMIDDLE5->Button(
#	-width => 79,
#	-text    => 'Stop exploit',
#	-command => sub {&STOP}
#	)->pack(-side => 'bottom', -expand => 1, -fill => 'both');

#$FrameMIDDLE5  -> pack (-side => 'top');
#------------ LAUNCHING THE MAIN LOOP --------
&EXPLANATION;
MainLoop;
#------------ END OF THE GUI INTERFACE DEFINITION STUFF -------------------------------------
sub LAUNCH()
{
	#threads are a necessity to be performant enough to create a DoS on CUCM
	# Without them the attack is much too slow to impact the solution.
	$Stop = 0;
#	$thr = threads->new(\&LAUNCHEXPLOIT); # Create the tehreads
 # 	$thr->detach; # Execute the whole SETPACKET subfunction and kill himself. 
}
	
sub LAUNCHEXPLOIT
{

	$TextWidget -> delete('0.0', 'end');
	
	if ($IP_Address =~ /[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}/)
    {

		$TextWidget -> insert ("end", "------------------------------- START -----------------------------------------\n");		
		$TextWidget->update();
		$TextWidget  -> see ('end');
		my $result:shared = "";
		my $commande1:shared = "sh Exploits/snom_call_tap-1.sh $IP_Address $Phone_number";

		#$thr = threads->new($result = `$commande1`);
				
		$result = `$commande1`;
		$TextWidget->insert ("end","$result\n");
								
		$TextWidget -> insert ("end", "-------------------------------- END ------------------------------------------\n");		
		$TextWidget->update();
		$TextWidget  -> see ('end');			
	}
	else
	{
    	$subweb_mw->Dialog(-title => 'WARNING', 	
					-text => 'Bad IP address syntax !',
					)->Show( );		
    }
}

sub EXPLANATION
{
	$TextWidget -> delete('0.0', 'end');
	$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");
	$TextWidget -> insert ("end", "Vulnerability: SNOM VoIP Phone Remote Call Place and Remote Tap\n");
	$TextWidget -> insert ("end", "Date: 10/09/2010\n");	
	$TextWidget -> insert ("end", "Author: Shawn Merdinger \n");
	$TextWidget -> insert ("end", "Website Link: http://voipsa.org/blog/2010/09/07/its-a-feature-remote-tapping-a-snom-voip-phone\n");
#	$TextWidget -> insert ("end", "Tested on Version: Snom 320 7.1\n");
#	$TextWidget -> insert ("end", "Patch: unknown\n\n");
	$TextWidget -> insert ("end", "\nDESCRIPTION:\n");
	$TextWidget -> insert ("end", "Some Snom VoIP phones have a feature called -PCAP Trace- that allows, via the web interface, the start/stop and download of a PCAP file on the Snom VoIP phone. The Snom PCAP Trace feature does have limitations in that it the PCAP data is stored in a circular buffer because of memory limitations, and that enabling PCAP capture can impact the phone’s performance (no surprise here). Still, it is a scary feature that if not secured creates an attack vector where a remote attacker can literally tap your phone.

To start/stop a PCAP on the Snom VoIP phone, one just clicks on the -Start- or -Stop- buttons on the phone webpage. After the capture is complete, an attacker can then download the PCAP trace and extract the audio using Wireshark or the amazing command-line RTPbreak by Michele Dallachiesa.

So, combining the web page place call feature with the PCAP trace feature, an attacker can make a Snom VoIP phone call any number and then the attacker can capture the call remotely on the Snom VoIP phone. For the final touch, an attacker can also delete the call record of the last call made, thereby wiping the apparent record of the call, at least on the Snom VoIP phone itself.\n\n");

	$TextWidget -> insert ("end", "WORKAROUND\n");
	$TextWidget -> insert ("end", "Disable the web interfaces as soon as possible.\n");
	$TextWidget -> insert ("end", "Change default passwords.\n");
	$TextWidget -> insert ("end", "Keep IP Address private (public networks are to avoid)\n");
	$TextWidget -> insert ("end", "-------------------------------------------------------------------------------\n");
	$TextWidget  -> update ();	
		
}

sub STOP()
{
	$Stop=1;
	$TextWidget->insert ("end","\n\nExploit is stopped\n");		
	$TextWidget->insert ("end","-------------------------------------------------------------------------------\n");
	$TextWidget->update();
	$TextWidget  -> see ('end');
}
	

sub SAVERESULTS
{
	my $FileToSave = $subweb_mw->getSaveFile(
							-defaultextension => '.txt',
                            -initialdir => "user_data"
                              );

	open (TOSAVE, ">>$FileToSave");
	print TOSAVE $Results;
	close (TOSAVE);
	
}	
