| VOIP Sound Board |
|
|
|
| Written by Justin Furniss | |
| Friday, 11 May 2007 | |
My buddy and I put together this basic tool which is used to injection pre-recorded audio into a VOIP conversation. This is done without the knowledge of the callers on the call. As far as I know, this has only been tested with Vonage but should work for other carriers as well. Click read more for details and how to install it.  {clab_tags} DisclaimerThis tool has been created solely for educational purposes. The creators of this tool and the creators employer [ http://www.xacta.com ] accept no responsibility for any use of this tool under any circumstances. That being said, please use this at your own risk.IntroductionThe VOIP Board tool that Andrew Reifers and I wrote is a Java application that allows a user to conveniently inject audio into an established RTP stream. The tool mostly makes use of tools created by the authors of ‘Hacking VOIP Exposed’ [http://www.hackingvoip.com/sec_tools.html], David Endler and Mark Collier.When I get the chance I am going to put this up on Sourceforge. The two tools used are ‘rtpinsertsound’ which inserts a sound over data being sent from one side of the VOIP connection, and ‘rtpmixsound’ which mixes a sound with the data being sent from one side of a VOIP connection. Both ‘rtpinsertsound’ and ‘rtpmixsound’ are fairly simple tools to use. The syntax of the commands require that the IP addresses and local ports of both clients of a RTP stream as well as the path to the desired audio file be entered to insert/mix the audio. VOIP Board was created to make it easy to quickly switch between different audio files, sending the audio in different directions, and ‘muting’ specific clients without having to quickly manipulate the command line arguments. The tool is, or at least I hope, fairly intuitive to use. The most important requirement of VOIPBoard is the same as rtpinsertsound/rtpmixsound, in that the VOIP stream must be flowing through the system in which VOIP Board is going to be run. This can be accomplished by performing a man-in-the-middle (mitm) attack on the local network using a tool such as arpspoof [http://www.monkey.org/~dugsong/dsniff/], or ettercap [http://ettercap.sourceforge.net/]. If you are in a situation where you have a machine which is legitimately already inline with the local network’s outbound traffic, assuming that your VOIP connection is going out to the Internet, then the required tools should work fine and lucky you! Known Issues
InstallationThe basic requirements of VOIPBoard are as follows:first the requirements for rtpinsertsound and rtpmixsound:
I have created a tarball of the libraries that are listed above with the exception of libnet and libpcap (these should be available via which ever package management system yout distro uses). The tar is available here: http://primeobsession.com/downloads/VoipBoard-dependencies.tar.gz The VoipBoard tarball can be found here: http://primeobsession.com/downloads/VOIPBoard-0.3.tar.gz. There is a wav file called 'silence.wav' in the directory when it is untarred. That file is a silent WAV file that is used to 'mute' the clients by doing a rtpinsertsound. It is important to make sure that VOIPBoard.jar and silence.wav are in the same directory. The requirements for VoipBoard are:
(*) rtpInsertSound and rtpMixSound both have modes which allow the user to modify how long they wait to inject the audio. When trying to inject sounds, it is best to have the sound injected when the ‘inject sound’ button is clicked. The quickest I could get either of the tools to inject audio was with a delay of 1 second, which can really mess up the timing of things. In the tarball I have provided I have the modified sources for rtpInsertSound and rtpMixSound. The changes made are to one line which allows the application to instantly skip the delay for insertion or mixing. Both 'rtpinsertsound' and 'rtpmixsound' should be placed somewhere in your executable path once they have been successfully compiled. Once'rtpinsertsound' and 'rtpmixsound' are compiled it would be worth while to test them out manually to insure that they are working correctly. The easiest way to do this is to, intercept the RTP stream, run tcpdump and look for the packets being sent between the local VOIP client and its gateway. Take note of the IP addresses and local ports of the gateway and the local client. Both of 'rtpinsertsound' and 'rtpmixsound' require the same flags for operation: ( you need to be root for this ) localhost #: rtpinsertsound -i <interface> -a <client IP> -A <client port> -b <remote client or gateway IP> -B <remote port> /path/to/wav/file -f <spoof factor> -j <jitter factor> Once you get that working you should be ready to fire up VoipBoard. As root or using sudo run:localhost #: java -jar VOIPBoard.jar Using VOIPBoardOnce the application is running, enter the local VOIP client's IP address into the local VOIP host text box then click 'Search for VOIP Stream'. If there is a stream going through the interfaces on the local machine, it should rather quickly display the IPs and Ports below. Click the 'Wav Dir...' button and select the directory which contains all of your WAVs to play. If everything is going as planned your should be able to click on the 'Play to local/remote Host' buttons to inject audio one way or 'Send to both' to send the audio both ways. Note the 'Mix Audio' and 'Insert / Replace Audio' radio buttons. They, as you would expect, switch between rtpinsert and rtpmix. The 'Mute' checkboxes will start a look playing the silence.wav file to the specified host. Creating Playable WAV FilesOnce the file that you wish to play has be converted to a WAV file ( for mp3 you can use 'mpg123 -w outfile.wav infile.mp3 '), then convert it to a supported WAV format. For more information on this read the Readme files included with rtpinsertsound and rtpmixsound. I have had the most luck using:localhost #: sox infile.wav -c 1 -r 8000 -u outfile.wav If everything went as planned, create a directory containing all of the WAV files that you want to inject into conversations and have fun!!! |
|
| Last Updated ( Friday, 29 June 2007 ) |