1

My network operator offer me VOIP service with free calls included, but it does not provide me VOIP credentials. So I can use VOIP with the phone connected to their router (which is configured for VOIP) but I can't configure VOIP on my mobile phone for example.

I have full access to their router with administrator password, I can see VOIP settings: username, server, port, everything except the password which is shown with "******".

So my question is, any way to get it?

I tried some password based on other passwords that have been given to me from the operator for other services, but no luck, every time I dial a number a voice tell me that VOIP password is incorrect.

I tried exporting the outer configuration over a file, but in the file the password is hashed, not even sure if MD5, I tried with online decrypters but no luck.

Any help? :)

andQlimax
  • 778
  • 10
  • 24
  • Have you already tried looking into the HTML source code of the page where the password is being shown as `******`? You'd be surprised, but I've actually seen cases where a cleartext password is right in there. :) – cnst Mar 29 '16 at 19:37
  • Yes I tried, nothing :) I also tried with a chrome plugin to reveal password and hidden fileds, but no luck..Thanks for the hint. Anything else? There must be a way – andQlimax Mar 29 '16 at 19:38

1 Answers1

0

SIP uses the authentication protocol also known as HTTP Digest, which uses the MD5 hash function in order to hash the authentication information together with a nonce from the server in order to avoid the replay attacks.

Since you're asking this on StackOverflow, a site for programmers, not reverse engineers, I shall assume that you want to write a workaround app.

So, basically, unless TLS is involved, what you may get away with is creating a sort of a MitM infrastructure which would work as follows:

  1. Your true client and/or intermediary connects to the real server, sees the nonce.

  2. You send the nonce received in the step above to a fake SIP server at home, which you place in front of the VoIP box.

  3. VoIP box connects to your fake server, gets the fresh nonce, hashes authentication information, and sends it back.

  4. Your fake server sends the authentication information it has received back to the real client/intermediary.

  5. The client/intermediary sends it back to the real server, after merely a few roundtrips of a delay. :-)

There might certainly be an easier way to accomplish the above, and the key is that SIP could absolutely legitimately be proxied, as well as a lot of other things to go into. :-) Also, I haven't truly verified that the above is correct with SIP (e.g., whether any sort of session data might get in the way to require or prohibit nonce reuse for subsequent requests as part of the same session), but I think something like that would work.

http://www.site.uottawa.ca/~bob/gradstudents/DigestAuthenticationReport.pdf seems to provide some nice introduction to the topic.

cnst
  • 25,870
  • 6
  • 90
  • 122
  • seems not easy :) I have some experience with proxies, but with above steps what hardware i need? I can use voip only if I connect a phone via RJ11 port..how the proxy can interact with it? – andQlimax Mar 29 '16 at 20:53
  • I would be more interested in retrieving the VOIP password in some way..I just tried via CLI "cisco like" commands, but of course password is shown hashed.. – andQlimax Mar 29 '16 at 20:56
  • @andQlimax, you'd simply use a firewall to figure out what hostname your VoIP device uses, and then insert a route to redirect all such traffic to a fake server. – cnst Mar 29 '16 at 21:15