Calling it a 0-Day: Hacking at PBX & UC Systems
Dissects enterprise Private Branch Exchange (PBX) and Unified Communications platforms, chaining Java execution and PHP decryption bugs to gain root shells.
Summary
The Attack Surface of Enterprise Unified Communications
On-premises Private Branch Exchange (PBX) and Unified Communications (UC) systems manage voice, video conferencing, and messaging across enterprise corporate networks.
Auditing Leading Commercial PBX Platforms
The author audits two widespread enterprise PBX products, analyzing proprietary management web consoles, telephony services, and licensing mechanisms.
Chaining Vulnerabilities from Phone Emulation to RCE
Exploitation steps include spoofing VoIP phone endpoints, decrypting obfuscated proprietary PHP source files, bypassing license checks, and abusing Java `Runtime.exec()` invocations.
Hardening Enterprise Communications Infrastructure
The presentation outlines detection signatures for malicious SIP registration traffic and provides remediation guidance for securing on-premise telephony gateways.
Related talks
Main Stage·38 min
Thomas Chauchefoin · Paul Gerste
Uncovers critical RCE vulnerabilities in Visual Studio Code, demonstrating how malicious repository configurations bypass Workspace Trust protections.
Main Stage·48 min
David Leadbeater
David Leadbeater revisits 60 years of terminal escape sequence vulnerabilities, detailing multiple remote code execution flaws across major terminal emulators.
Main Stage·35 min
Jonathan Birch
Jonathan Birch demonstrates novel .NET deserialization RCE attacks that bypass standard assumptions, exploiting database drivers and immutable data streams.