A security problem: false calls from within the system

General Help
1

I use FreePBX Distro FreePBX 12.0.76.2 Asterisk 11

[Thanku-outcall]; thankuohoh malicious macro inserted…

[thanku-outcall]; thankuohoh
exten => _.,1,Macro(user-callerid,LIMIT,EXTERNAL,); thankuohoh
exten => _.,n,Set(MOHCLASS=${IF($["${MOHCLASS}"=""]?default:${MOHCLASS})}); thankuohoh
exten => _.,n,Set(_NODEST=); thankuohoh
exten => _.,n,Macro(dialout-trunk,1,${EXTEN},on); thankuohoh
exten => _.,n,Macro(dialout-trunk,2,${EXTEN},on); thankuohoh
exten => _.,n,Macro(outisbusy,); thankuohoh

It installs again and again on extensios_custom.conf and fills the system with outgoing calls that doesn’t get out but clog the system and the connection. I joggle between ip addresses to stop it and let the system work but I can’t get read of it. Any suggestion on how to clean the system or I have no option but reinstall it?

Also, the Intrusion Detection of Sys Admin module no longer active, while fail2ban seems to be working…Can I revive that function?

2

Hi,

You need to search for the script that inserts this context. Try to run this command in your Linux console:

fgrep -R thankuohoh /etc

I have a feeling that you are using Elastix and it suppose to be in the /etc/asterisk_extensions_custom.conf file. Make sure to delete this file and the references to this file in the asterisk directory (more details here). If you are using also the A2Billing in this version of Elastix please make sure that you will read this link.

Basically, it means that you have to search the file that gives admin permissions to Elastix portal. The file’s name is A2B_php_stats.php. Make sure to delete this file and to correct the admin/Public/A2B_entity_restore.php file.

Thank you,

Daniel Friedman
Trixton LTD,

3

Thank you for your advice.

As I stated in my post I DO NOT use Elastix nor do I have a2billing installed. It is a FreePBX distro.

I’m quite aware of the holes existing in Elastix and seldom use it for totally locked systems from the outside world.

Since it is a small business, I installed a few weeks ago VtigerCRM on the same machine with Asterisk Integration.Could it be there the vulnerability comes from?

4

Likely you are using an unpatched “asterisk recordings interface”. This was one of the reasons we do module signing now. Note you likely have a system call in some random file that calls every time you load up a page. The safest move is to reinstall. If you install FreePBX 12+ it has module signing that will raise a flag if any files are tampered with.

5

I do use FreePBX 12. Patched long time ago the ARI

6

do you have any tampered file warnings?

try

amportal a ma refreshsignatures
7

Hi,

You should had run my command fgrep -R thankuohoh /etc/ or fgrep -R thankuohoh /var/www/ to see where is that file that is inserting this context.
I am quite sure that you have a php file that is injecting this context and you have to find it and delete it.
Close the web ports to the world until you will figure this out or reinstall your system.

Thank you,

Daniel Friedman
Trixton LTD.

8

These hacks usually base64 encode things or use a url to pull a script to tmp and run it. grep won’t find it.

9

Hi,

It is fgrep not grep. There is a file that is running every night. I would also check the cron library to verify that there is not a new daily cron that is running it.

Thank you,

Daniel Friedman
Trixton LTD.

10

wrong again. They compromise a file then they call that file remotely it is not cron.

11

Well, I did find 2 PHP files and one link and deleted it. using
amportal a ma refreshsignatures

Will keep on checking…Thx

I just wonder why it doesn’t act with all the IP Addresses I assigned to that server, When I close one of the connections - it stops…

12

Hi,

Well @jfinstrom ??? Was I wrong? The hacker uploaded a php file that gained him admin permissions through the Vtiger and then inserted this context to the Asterisk’s dialplan.

@adorah1, do you still have these file names? Did you checked its content?

Thank you,

Daniel Friedman
Trixton LTD.

13

I just deleted them. I should have kept them for reference, sorry.
One was installed in /var/www/html/admin
the other was installed in the recording section…

14

Hi,

Check in your history commands. You can type history in your linux console.

Thank you,

Daniel Friedman
Trixton LTD.

15

OK I checked Vtiger folder and found one more PHP file of the same name…I just don’t know how to upload such a file that is now in a .txt file…or it may do some harm…

16

Hi,

Please post the file’s name and its content.

Thank you,

Daniel Friedman
Trixton LTD.

17

The file name (The same in the respective folders is ELMAYET_ELMAYET.php )
For some reason I can’t upload the .tgz file…uploading stuck…
I also found several Base 64 files in VtigerCRM folder and moved them away (Keep them this time)

18

no need to upload here…

Note:
https://www.exploit-db.com/search/?action=search&description=vtiger&e_author=

Most recent September 2015

1 Like
19

Once the entries in extensions_custom.conf are removed, be sure to check for and
remove config.php file located in /var/www/html/admin/libraries/php-upgrade/ext

Otherwise, the hackers will still have access to your system.
The config.php file is not part of the distro or FreePBX.

20

For more details, including hidden .header.php and .marvels.php files found with this exploit, see
http://community.freepbx.org/t/i-ve-been-hacked-macro-thanku-outcall-thankuohoh/32897