Default Password in FreeSWITCH Event Socket

This repository contains a single Metasploit module: 'FreeSWITCH Event Socket Command Execution'. The module exploits CVE-2019-19492, a vulnerability in FreeSWITCH's event socket interface, which by default listens on TCP port 8021 and is protected by a password (default: 'ClueCon'). The exploit allows an attacker with access to the event socket and valid credentials to execute arbitrary system commands using the 'system' API command. The module supports multiple platforms (Linux, Unix, Windows, BSD) and architectures (x86, x64, CMD), and can deliver a variety of payloads, including Meterpreter reverse shells and PowerShell payloads, using both in-memory and dropper techniques. The exploit is weaponized, highly configurable, and leverages Metasploit's payload and command stager capabilities. The only file in the repository is the Metasploit module itself, written in Ruby.

This repository provides a Python exploit for FreeSWITCH servers vulnerable to CVE-2019-19492. The main script, 'exploit.py', allows an attacker to execute arbitrary system commands on remote FreeSWITCH instances by connecting to the event socket interface (default TCP port 8021) and authenticating with the default password ('ClueCon'). The exploit supports targeting a single host, a list of hosts, or automatically discovering targets via Shodan (requiring a valid Shodan API key). Results of successful exploitation (i.e., vulnerable hosts) are written to an output file (default: 'vulnerable.txt'). The script also features an interactive shell for command execution on a single target. The repository includes a helper script, 'parser_zoomeye.py', for processing Zoomeye search results, and a 'requirements.txt' file listing necessary Python dependencies. The exploit is operational, providing real command execution on vulnerable systems, and is not a detection-only tool.

This repository contains a Python exploit for FreeSWITCH servers vulnerable to CVE-2019-19492. The exploit targets the event socket interface (default TCP port 8021) and attempts to authenticate using the default password ('ClueCon'). Upon successful authentication, it can execute arbitrary system commands on the target server. The script supports two modes: targeting a single specified IP (with an interactive shell for command execution), or automatically discovering targets via Shodan (requiring a valid SHODAN API key) and executing commands on each. Results of successful exploitation are saved to a file (default: 'vulnerable.txt'). The repository consists of a README.md with usage instructions and warnings, and a single exploit script (exploit.py) implementing the described functionality. The exploit is operational, providing real remote command execution capabilities against vulnerable FreeSWITCH instances.