CcIE Voice Hacking

From: Ashwin Iyer (ash.iyer@gmail.com)
Date: Thu Aug 14 2008 - 05:47:34 ART


Dear Voice experts
One of my customer has encountered a strange problem.His voice network is
being hacked from outside.It seems and this is my guess that some one from
outside is dialing to their board number and that call is going to voice
mail numbers (5000,7000-7099) and from their it is being transfered out to
PSTN.So it looks like a call made from inside.We have atleast elimiated the
possibility of this done from some one inside.I would like some suggestions
as to how this can be done from outside.I am attaching voice-gateway
configs.He does not have call mgr express.He only has call manager 4.1 I am
not much of a voice expert.So kindly help

thanks and rgds
Ashwin Iyer
sh run
Building configuration...

Current configuration : 7261 bytes
!
! Last configuration change at 12:37:45 UTC Tue Aug 12 2008
! NVRAM config last updated at 12:37:41 UTC Tue Aug 12 2008
!
version 12.3
service nagle
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug uptime
service timestamps log datetime msec localtime
service password-encryption
service sequence-numbers
!
hostname ALBARAMI
!
boot-start-marker
boot-end-marker
!
logging buffered 4096 debugging
logging console informational
 --More--  enable secret 5 $1$.e7E$Ao36PXAUtT.RPQTmqzLZY1
!
clock timezone UTC 4
clock calendar-valid
network-clock-participate wic 0
network-clock-select 1 E1 0/0/0
no aaa new-model
ip subnet-zero
no ip source-route
no ip gratuitous-arps
ip telnet hidden addresses
!
!
ip cef
!
!
ip domain name bgc.local
ip name-server 212.72.1.186
ip name-server 198.6.1.1
no ftp-server write-enable
isdn switch-type primary-5ess
!
voice-card 0
 --More--   no dspfarm
!
!
voice rtp send-recv
!
voice service voip
 allow-connections h323 to h323
 allow-connections h323 to sip
 allow-connections sip to h323
 h323
!
!
!
!
!
voice class h323 1
 h225 timeout tcp establish 5
!
!
!
!
!
!
 --More--  voice translation-rule 2
 rule 1 /24583900/ /5000/
 rule 2 /2458\(....\)/ /\1/
!
!
voice translation-profile incoming
 translate called 2
!
!
!
!
username cisco privilege 15 secret 5 $1$EYGK$E2yWN49qbdJ4bQ5zA4sfu1
!
!
controller E1 0/0/0
 pri-group timeslots 1-31
 description ******* Voice PRI to OMANTEL ********
!
!
!
interface FastEthernet0/0
 no ip address
 shutdown
 --More--   duplex auto
 speed auto
 no cdp enable
!
interface FastEthernet0/1
 description ******** Port connected to Core Switch *******
 ip address 11.1.1.1 255.255.255.0
 ip access-group 150 in
 ip access-group 150 out
 ip directed-broadcast
 ip nat inside
 ip tcp adjust-mss 1452
 duplex auto
 speed auto
 no cdp enable
 h323-gateway voip interface
 h323-gateway voip bind srcaddr 11.1.1.1
!
interface Serial0/0/0:15
 no ip address
 ip mroute-cache
 no logging event link-status
 isdn switch-type primary-5ess
 --More--   isdn incoming-voice voice
 isdn T306 60000
 isdn T310 60000
 no cdp enable
!
interface ATM0/2/0
 no ip address
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface ATM0/2/0.1 point-to-point
 pvc 8/64
  pppoe-client dial-pool-number 1
 !
!
interface Service-Engine1/0
 description ****** VoiceMail Module *******
 ip unnumbered FastEthernet0/1
 service-module ip address 11.1.1.3 255.255.255.0
 service-module ip default-gateway 11.1.1.1
 no cdp enable
!
interface Dialer0
 description ******* ADSL dynamic IP data link *******
 ip address negotiated
 ip mtu 1452
 ip nat outside
 encapsulation ppp
 dialer pool 1
 dialer idle-timeout 3600
 dialer wait-for-carrier-time 5
 dialer-group 1
 no cdp enable
 ppp authentication chap pap callin
 ppp chap hostname bgcmct
 ppp chap password 7 121A15454311075727
 ppp pap sent-username bgcmct password 7 121A15454311075727
!
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 10.1.1.0 255.255.255.0 11.1.1.2
ip route 10.1.2.0 255.255.255.0 11.1.1.2
ip route 10.1.3.0 255.255.255.0 11.1.1.2
ip route 11.1.1.3 255.255.255.255 Service-Engine1/0
ip route 14.1.1.0 255.255.255.0 11.1.1.2
 --More--  ip route 172.16.1.0 255.255.255.0 11.1.1.2 200
ip route 172.16.2.0 255.255.255.0 11.1.1.2 200
ip route 172.16.3.0 255.255.255.0 11.1.1.2 200
ip route 192.168.1.0 255.255.255.0 11.1.1.2 200
!
!
no ip http server
no ip http secure-server
ip http timeout-policy idle 5 life 86400 requests 10000
ip nat inside source list 1 interface Dialer0 overload
ip nat inside source static tcp 14.1.1.2 443 interface Dialer0 443
ip nat inside source static tcp 14.1.1.2 80 interface Dialer0 80
ip nat inside source static tcp 192.168.1.11 3389 interface Dialer0 3389
!
ip access-list extended ATTACK_MITIGATION
 deny tcp any any eq talk
 deny tcp any any eq finger
 deny tcp any any eq whois
 deny tcp any any eq gopher
 deny tcp any any eq discard
 deny tcp any any eq bgp
 deny tcp any any eq chargen
 deny tcp any any eq nntp
 --More--   deny tcp any any eq ident
 deny tcp any any eq uucp
 deny udp any any eq mobile-ip
 deny udp any any eq biff
 deny udp any any eq xdmcp
 deny udp any any eq netbios-ss
 deny udp any any eq netbios-ns
 deny udp any any eq sunrpc
 permit ip any any
ip access-list extended RFC1918
 deny icmp any any log
 deny ip 10.0.0.0 0.255.255.255 any log
 deny ip 172.16.0.0 0.15.255.255 any log
 deny ip 192.168.0.0 0.0.0.255 any log
 deny tcp any any eq finger
 deny tcp any any eq whois
 deny tcp any any eq uucp
 deny tcp any any eq discard
 deny tcp any any eq kshell
 deny tcp any any eq klogin
 deny tcp any any eq ident
 deny tcp any any eq gopher
 permit ip any any
 --More--  !
access-list 1 permit 14.1.1.0 0.0.0.255
access-list 1 permit 172.16.1.0 0.0.0.255
access-list 1 permit 172.16.2.0 0.0.0.255
access-list 1 permit 172.16.3.0 0.0.0.255
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 150 deny icmp host 11.1.1.3 host 192.168.1.3
access-list 150 permit ip any any
dialer-list 1 protocol ip permit
no cdp run
!
!
!
control-plane
!
!
!
voice-port 0/0/0:15
 translation-profile incoming incoming
!
!
!
!
dial-peer voice 1 pots
 tone ringback alert-no-PI
 destination-pattern .T ***********************
 progress_ind setup enable 3
 fax rate voice
 direct-inward-dial
 port 0/0/0:15
!
dial-peer voice 7 voip
 tone ringback alert-no-PI
 shutdown
 destination-pattern .T
 progress_ind setup enable 3
 progress_ind progress enable 8
 voice-class h323 1
 session target ipv4:192.168.1.3
 dtmf-relay h245-alphanumeric
 codec g711ulaw
 fax rate disable
 fax protocol pass-through g711ulaw
 no vad
!
dial-peer voice 9 voip
 --More--   tone ringback alert-no-PI
 destination-pattern 3...
 progress_ind setup enable 3
 voice-class h323 1
 session target ipv4:192.168.1.3
 dtmf-relay h245-alphanumeric
 codec g711ulaw
 fax rate disable
 fax protocol pass-through g711ulaw
 no vad
!
dial-peer voice 2 pots
 tone ringback alert-no-PI
 incoming called-number 24583900
 fax rate voice
 direct-inward-dial
 port 0/0/0:15
!
dial-peer voice 4 voip
 tone ringback alert-no-PI
 destination-pattern 5...
 progress_ind setup enable 3
 voice-class h323 1
 --More--   session target ipv4:192.168.1.3
 dtmf-relay h245-alphanumeric
 codec g711ulaw
 fax rate disable
 fax protocol pass-through g711ulaw
 no vad
!
dial-peer voice 3 voip
 tone ringback alert-no-PI
 voice-class h323 1
 session target ipv4:192.168.1.3
 incoming called-number .
 dtmf-relay h245-alphanumeric
 codec g711alaw
 fax rate disable
 fax protocol pass-through g711alaw
 no vad
!
!
banner motd ^C
WARNING !!! This is secure device and highly restricted area. Your steps and workings will be logged and read on scheduled basis, so if you are NOT A LEGITIMATE USER , please log off, or serious actions can be taken AGAINST Violators ...
 --More--  ^C
!
line con 0
 password 7 1511021F0725
 logging synchron

Blogs and organic groups at http://www.ccie.net



This archive was generated by hypermail 2.1.4 : Mon Sep 01 2008 - 08:15:30 ART