Been hacked - help me figure out how

[yzpilot]

I believe a customer of mine has been hacked. I'd like to figure out how it happened so that it doesn't happen again.

Here are some details:

Discovered attempted calls to country code 44 at 05:57 this morning local time (US CDT)
Looked at CDR, see attempts coming from context sip-external
Logged into Elastix GUI, get lots of php errors.
Look at /var/www/html/..... and see files modified at 03:46 this morning.
Last login is user asterisk at 03:46

Security details:
No http or https access allowed from outside. Blocked by border firewall and verified.
No ssh allowed from outside.
Password login via SSH disabled. Need key to login.
Only ports open to outside are 5060 and 10,000 - 20,000
Old "messages" logs are gone. New messages log starts at 04:02.
Lots of log files show modification time of 04:02
Apache ssl logs modified at 4:02

Based on the fact that the Apache SSL logs where whacked I'm guessing they made their changes via Apache and specifically FreePBX (/admin directory) across the LAN because there is just no HTTP or HTTPS access from the outside.

Anyone got any comments, ideas, experiences?

 

[danardf]

Hi...

I cannot explain how a guy could hack your server. However i can explain you how i did.
Using iptables.
I accept only every trusted IP and open only some ports, like for example: SIP, RTP, or else.
I configured a (deny / permit) on each trunks and extensions being connected on the server.
Fail2Ban is installed also and configured for ban all bad authentications at first, instead of waiting 3 attempts to banning an IP address.

Don't accept any international calls.
You could use some PIN set or other secret codes for each outgoing routes.

Check if your SIP parameters allow the anonymous connexion. Do not allow this parameter.

Hmmm that's all.

 

[superiorit]

I'll throw in my $.02....

We have quite a few Elastix boxes out there that we support. None have been hacked. I am not bragging, I am just stating a fact. Some have been running for years. Some have 5060 and 10000-20000 open.No issues.

Did you have webmin installed and running on 10000? If not and there were no other services (other than Asterisk), I doubt you were hacked from that box. Most likely another box on the network was compromised and they used it to hack it since most likely you have all ports open on the local lan side.

 

[bobzibub]

A snippet of index.php:

if(isset($_POST['submit_login']) and !empty($_POST['input_user'])) {
    $pass_md5 = md5($_POST['input_pass']);
    if($pACL->authenticateUser($_POST['input_user'], $pass_md5)) {
        $_SESSION['elastix_user'] = $_POST['input_user'];
        $_SESSION['elastix_pass'] = $pass_md5;

I could be wrong but a superficial glance at index.php makes me think. For md5 is broken (they should be using sha5/sha512) and there is no salt added. Plus, everyone has "admin" as a user name. One might consider salting that too.

B

EDIT:
1) Salting the admin probably doesn't have much return on the effort.
2) Looking at $pACL->authenticate user, it stores the md5 password digest in the session. I could be wrong again.... But, say you log into your pbx as admin, then you go to elastix.org forum and someone hacks it to places javascript in a posting that you read-- it could spit out your pbx MD5 digest, and your IP. Then someone could use rainbow tables to get your password and go to town on your pbx.
3) I think it is a good idea not to have this system publicly available.
EDIT 2:
4) the session variables never seem to expire.