How to Setup a Trixbox image using Vmware player

How to Setup a Trixbox image using Vmware player.

This guide will show you how to setup a target PBX machine in your own pentesting lab.
This will allow you to use several tools that are available in BT in order to learn about VOIP.

So this guide will assume a few things.
1. You have at least two computers on some sort of network
2. One of them is capable of running BT
3. The other is running windows xp.

Now if you need help with any of that then see
google

Now in order to get our machine setup we need to download a few things.
1. the player
2. the trixbox image

You need to download the Vmware image titled: trixbox CE 2.6.0.7
There are md5sums for it as well.

Ok now setup the vmware player as per the documentation
Next you will need to unzip the trixbox image.
Once this is done you will need to start the player. Once it opens chose from the commands "open" and navigate to the folder where your recently unzipped folder.
Then find the file that is labeled "trixbox-ce-2.6.0.2" This is the needed image.
Now select open and the OS should start too boot inside of the player. It takes a few minutes to get to the log on prompt.
If there are any errors that prevent you from getting a root log in prompt then you will need to work those out first.
You can post in this thread but I can only offer limited help for this. Best go to the trixbox website.

Now that our OS is booted we can leave it alone.
If you have the desire you can log onto it using
logon:root
password: trixbox

But there is really nothing to see there.
You will do all configuration from the web gui interface.
You should also see on the player the IP address to access this web interface.
If not find the IP of your machine and this will be it.
Ok so on another machine open a browser and navigate to the IP address.

Then once you have the page the next few steps are real easy.
Upper right hand corner find the user mode and switch to maint.
you will need to supply the user and password

User: maint
Password: password

Now it will reload the page. Next find on the left side toward the top "Asterix" and then in the drop down "FreePBX"
Click on it and it reloads. This is the page where we can add our extensions. This is basically the user and there associated phone number.
Just like when you call some business or whatever and the prompt asks for an extension.
Choose in the middle the drop down box that should say "SIP" device.
Then you will need to fill out the following.
The extension number
You should give a name but it is not necessary.
Then down the list you will see "secret" this is the password field put something in there or leave it blank.

Next go to the very bottom and hit the submit button and back up to the top of the page is an orange button for adding the new extension to the database and turning it on.
At this point you are done. If you want to mess with the other features by all means go for it. For our testing purposes we are finished with the web interface.
You can the just navigate to another website or close the browser.


Now in order for us to make use of the SipVicious tools you will need to navigate to the SipVicious directory and add a word list.
The default is "dictionary.txt" At this point you can either add some words or whatever but you need to ensure that your secrets from above are in there.
Save the file and exit.

So to see the video that shows how to set up our trixbox please follow this link it will take you to blip.tv


For more info on using the SipVicious tools see my other tutorial here.

Hope you enjoy it and please leave some feed back!

There is also a thread over at remote-exploits forums for using the SipVicious tool set.

Join the conversation.

I should have the other video and thread (on setting up a target machine in your own private network) up later today.

Abusing VOIP Networks with SipVicious

As promised here is the video uploaded to blip.tv
You can get it here from blip.tv
It is also available from here on media fire for download
It is saved in the ".mpeg" format so you may need some sort of codec to make it work for you.
Hope you enjoy it !

SipVicious Hacking

I did a small video on using the SipVicious tools under Back|Track
I will post more info later at the remote exploits forums.
I will also post a small video on setting up our target machine.
There are two formats for the video a .html and a .swf

The files have been pulled temporarily will repost them later on tonight.

Here are a few VOIP Info tutorials I have picked up in the last few days
they are hosted on mediafire.com There are 3 .PDF files in one folder


I am currently finishing up a thread that I will post with lots of info about VOIP on the Back|Track Forums.

Sipvicious

There is mention of my tutorial over on the Sipvicious website.
Nothing special just mentions the tutorial and the fix for the tool in Back|Track 3 beta on the
Back|Track Wiki

Special thanks to Sandro Gauci for making this tool and sharing it with the community.

Small SipVicious Guide

Small SipVicious Guide

This is a small guide on getting the SipVicious tool pack

SIPVicious suite is a set of tools that can be used to audit SIP based systems. It currently consists of four tools:

* svmap - this is a sip scanner. Lists SIP devices found on an IP range
* svwar - identifies active extensions on a PBX
* svcrack - an online password cracker for SIP PBX
* svreport - manages sessions and exports reports to various formats


The home page is located here: Blog

The code is here: Code

SipVicious requires python 2.4 or greater. For BT2 and 3 beta you have this so no need to worry.

There is a video tutorial that will help you out on setting it up and a small walk through using the tools located here:
Video
This video uses the tools found on the Getting Started page below.

There is also a page with info on setting up a VMware player and Trixbox image to use SipVicious against located here:
GettingStarted

The whole thing is pretty straightforward and easy to use.

Have fun with your SIP auditing!

Special thanks to Sandro Gauci for making the tools and video!