The Hack o blog

Reinventing the weel

Hacking Cisco phones with the Fonz

The Fonz on a Cisco phone


I was stumbling thru one of my favourite forums today and found a epic hack by the forum member Trepalium

It involves the Fonz so it’s got to be cool any way check it out hear

haayyyy , Its the Fonz

make a PNG file and place it at C:\CiscoWebs\IPPhoneServices\CCMCIP on the Cisco Call Server

I then need to write the XML file that will tell my cisco phone to show this picture.

Trepalium’s looks like this

<CiscoIPPhoneImageFile>
  <Title>The Fonz</Title>
  <Prompt>Heeeeyyy! Its the Fonz!</Prompt>
  <LocationX>10</LocationX>
  <LocationY>10</LocationY>
  <URL>http://<yourciscoserverip>/CCMCIP/fonz.png</URL>
</CiscoIPPhoneImageFile>

Then saved this xml file somewhere (C:\ for me)



I then wanted to write a way to send the HTTP Request to my phone. 
Here's the code I used for my visual studio console project. Note that 
when you are prompted for IP address, username, and password that it is 
the IP Address of the phone, the username of the user that the set 
belongs to and that user's pin that they use for CallManager. Also you 
will want to replace C:\.xml with the path to your XML file.

Imports System.Collections.Generic
Imports System.Text
Imports System.Net
Imports System.IO
Imports System.Web


Module Module1

    Sub Main()
        Console.WriteLine("Send a simple XML Command to a CISCO IP Phone")
        Console.WriteLine()

        Dim IPAddressOfPhone As String = InputBox("Enter IP")
     
        Dim PushXML As String
     
        Dim sr As StreamReader
        sr = New StreamReader("C:\lol.xml")
        PushXML = sr.ReadToEnd


        Console.WriteLine("Sending the following POST data:")
        Console.WriteLine()
        Console.WriteLine(PushXML)
        Console.WriteLine()

        PushXML = "XML=" & HttpUtility.UrlEncode(PushXML)
        SendXML(PushXML, IPAddressOfPhone)



    End Sub
    Public Sub SendXML(ByVal XML As String, ByVal IP As String)
        Dim resp As WebResponse = Nothing
        Dim ResponseXML As String = ""
        Dim ErrorCode As String = ""
        Dim HTTPServerTimeoutMS As Integer = 30000
        Dim PhoneURL As String = String.Format("http://{0}/CGI/Execute", IP)
        Try
            ServicePointManager.Expect100Continue = False
            Dim req As HttpWebRequest = DirectCast(WebRequest.Create(PhoneURL), HttpWebRequest)
            req.Timeout = HTTPServerTimeoutMS
            req.Method = "POST"

            req.Credentials = GetCredentials()
            req.Accept = "*/*"
            req.ContentType = "application/x-www-form-urlencoded"
            req.KeepAlive = False
            req.Expect = ""

            Dim bytes As Byte() = Nothing
            bytes = System.Text.Encoding.UTF8.GetBytes(XML)
            Dim outputStream As Stream = req.GetRequestStream()
            outputStream.Write(bytes, 0, bytes.Length)
            outputStream.Close()

            resp = req.GetResponse()
            Dim s As Stream = resp.GetResponseStream()
            Dim stm As New StreamReader(s)
            If stm Is Nothing Then
                ErrorCode = "Timed out or no response!"
            Else
                ResponseXML = stm.ReadToEnd()
                stm.Close()
            End If
            s.Close()
            resp.Close()
        Catch ex As System.Net.WebException

            Dim StatusCodeString As String = ex.Response.ToString
            Dim StatusCodeNumber As Integer = ex.Response.ContentLength

            ErrorCode = String.Format("Web Exception : {0}" & vbCr & vbLf & vbCr & vbLf & "HTTP Status : {1} ({2})" & vbCr & vbLf & vbCr & vbLf & "Stack Trace:" & vbCr & vbLf & vbCr & vbLf & "{3}", ex.Message.ToString(), StatusCodeString, StatusCodeNumber, ex.ToString())
        Catch ex As Exception
            ErrorCode = String.Format("Exception : {0}" & vbCr & vbLf & vbCr & vbLf & "Stack Trace:" & vbCr & vbLf & "{1}", ex.Message.ToString(), ex.ToString())
        End Try
        If ErrorCode.Length > 0 Then
            Console.WriteLine(ErrorCode)
        Else
            Console.WriteLine()
            Console.WriteLine("Received the following XML response")
            Console.WriteLine()
            Console.WriteLine(ResponseXML)
        End If
        Console.WriteLine()
        Console.WriteLine("Completed... click ENTER to exit")
        Console.ReadLine()
    End Sub

    Public Function GetCredentials() As ICredentials

        Return New NetworkCredential(InputBox("Enter Username"), InputBox("Enter Pass"))
    End Function
End Module
  1. Advanced User Trepalium is just starting out Trepalium's Avatar


    Join Date
    Jun 2005
    Location
    Indianapolis, IN U.S.
    Posts
    253
    Thanks
    66
    Thanked 63 Times in 39 Posts
    Rep Power
    5

    Well here’s hows it’s done.

    First find a PNG file that is in black in white or at most an 8-bit color image. (Most cisco phones only show in B&W). Resize the image to fit on the phone screen.

    Now I take the PNG file and place it at C:\CiscoWebs\IPPhoneServices\CCMCIP on the Cisco Call Server

    I then need to write the XML file that will tell my cisco phone to show this picture.

    Mine looked like this

    Code:
    <CiscoIPPhoneImageFile>
      <Title>The Fonz</Title>
      <Prompt>Heeeeyyy! Its the Fonz!</Prompt>
      <LocationX>10</LocationX>
      <LocationY>10</LocationY>
      <URL>http://<yourciscoserverip>/CCMCIP/fonz.png</URL>
    </CiscoIPPhoneImageFile>

    Then saved this xml file somewhere (C:\ for me)

    I then wanted to write a way to send the HTTP Request to my phone. Here’s the code I used for my visual studio console project. Note that when you are prompted for IP address, username, and password that it is the IP Address of the phone, the username of the user that the set belongs to and that user’s pin that they use for CallManager. Also you will want to replace C:\.xml with the path to your XML file.

    Code:
    Imports System.Collections.Generic
    Imports System.Text
    Imports System.Net
    Imports System.IO
    Imports System.Web
    
    Module Module1
    
        Sub Main()
            Console.WriteLine("Send a simple XML Command to a CISCO IP Phone")
            Console.WriteLine()
    
            Dim IPAddressOfPhone As String = InputBox("Enter IP")
    
            Dim PushXML As String
    
            Dim sr As StreamReader
            sr = New StreamReader("C:\lol.xml")
            PushXML = sr.ReadToEnd
    
            Console.WriteLine("Sending the following POST data:")
            Console.WriteLine()
            Console.WriteLine(PushXML)
            Console.WriteLine()
    
            PushXML = "XML=" & HttpUtility.UrlEncode(PushXML)
            SendXML(PushXML, IPAddressOfPhone)
    
        End Sub
        Public Sub SendXML(ByVal XML As String, ByVal IP As String)
            Dim resp As WebResponse = Nothing
            Dim ResponseXML As String = ""
            Dim ErrorCode As String = ""
            Dim HTTPServerTimeoutMS As Integer = 30000
            Dim PhoneURL As String = String.Format("http://{0}/CGI/Execute", IP)
            Try
                ServicePointManager.Expect100Continue = False
                Dim req As HttpWebRequest = DirectCast(WebRequest.Create(PhoneURL), HttpWebRequest)
                req.Timeout = HTTPServerTimeoutMS
                req.Method = "POST"
    
                req.Credentials = GetCredentials()
                req.Accept = "*/*"
                req.ContentType = "application/x-www-form-urlencoded"
                req.KeepAlive = False
                req.Expect = ""
    
                Dim bytes As Byte() = Nothing
                bytes = System.Text.Encoding.UTF8.GetBytes(XML)
                Dim outputStream As Stream = req.GetRequestStream()
                outputStream.Write(bytes, 0, bytes.Length)
                outputStream.Close()
    
                resp = req.GetResponse()
                Dim s As Stream = resp.GetResponseStream()
                Dim stm As New StreamReader(s)
                If stm Is Nothing Then
                    ErrorCode = "Timed out or no response!"
                Else
                    ResponseXML = stm.ReadToEnd()
                    stm.Close()
                End If
                s.Close()
                resp.Close()
            Catch ex As System.Net.WebException
    
                Dim StatusCodeString As String = ex.Response.ToString
                Dim StatusCodeNumber As Integer = ex.Response.ContentLength
    
                ErrorCode = String.Format("Web Exception : {0}" & vbCr & vbLf & vbCr & vbLf & "HTTP Status : {1} ({2})" & vbCr & vbLf & vbCr & vbLf & "Stack Trace:" & vbCr & vbLf & vbCr & vbLf & "{3}", ex.Message.ToString(), StatusCodeString, StatusCodeNumber, ex.ToString())
            Catch ex As Exception
                ErrorCode = String.Format("Exception : {0}" & vbCr & vbLf & vbCr & vbLf & "Stack Trace:" & vbCr & vbLf & "{1}", ex.Message.ToString(), ex.ToString())
            End Try
            If ErrorCode.Length > 0 Then
                Console.WriteLine(ErrorCode)
            Else
                Console.WriteLine()
                Console.WriteLine("Received the following XML response")
                Console.WriteLine()
                Console.WriteLine(ResponseXML)
            End If
            Console.WriteLine()
            Console.WriteLine("Completed... click ENTER to exit")
            Console.ReadLine()
        End Sub
    
        Public Function GetCredentials() As ICredentials
    
            Return New NetworkCredential(InputBox("Enter Username"), InputBox("Enter Pass"))
        End Function
    End Module

    I also added System.Xml as a reference.

    Now all I have to do is run the project, type in the ip of the phone, type in the username, and the pass and it will send that to my phone.

    -Trep*Disclaimer* Trepalium sometimes talks out of his ass and could be wrong. *Disclaimer*


  2. The Following 2 Users Say Thank You to Trepalium For This Useful Post:

    Narada (Today), tux (Today)


  3. #4

    Mac Whore/ Drunken Pirate USL Developer zer0 is just starting out zer0's Avatar


    Join Date
    Mar 2005
    Location
    os x
    Posts
    1,304
    Thanks
    3
    Thanked 31 Times in 21 Posts
    Rep Power
    7

    that’s pretty damn cool man.




    Fight the control of the misinformed over the uneducated, do your part to liberate ignorant minds.

    narada: noob: help me….
    narada: gnome: die motherfucker die!

  4. #5

    Systems Moderator USL Developer Narada has his own fan club Narada has his own fan club Narada has his own fan club Narada's Avatar


    Join Date
    Jan 2006
    Location
    BFE, USA
    Posts
    2,151
    Thanks
    314
    Thanked 654 Times in 302 Posts
    Rep Power
    11

    *Kicks a vending machine, soda pops out*

    Very cool.


    When in doubt, fsck it.
    —————
    // Arch Linux x86_64 // Phenom II X4 955 Black Edition @ 3.8 GHz // 2 x 1 TB SATA 3.0 RAID 1 //
    // Mushkin 2 x 2 GB dual channel DDR3 @ 1066 MHz // Geforce 9600 GT 512 MB GDDR3 //

Advertisements

2 responses to “Hacking Cisco phones with the Fonz

  1. sam January 26, 2010 at 9:37 PM

    This was grate!

    • hackoblog January 28, 2010 at 3:31 PM

      thanks for the Comment Sam a bit more info next time :=

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: