Thank you and good morning. Before Dame Julia Pollock was appointed Dame Commander of the British Empire by Queen Elizabeth II in 2003, she was Dr. Julia Pollock, a young physician who moved with her family to London from her home in Argentina in 1968. She had obtained her medical degrees in early training in histopathology, the microscopic study of diseased tissue at the University of Buenos Aires. In England, she planned to pursue additional postgraduate studies in histopathology and after several years returned to Argentina. A permanent move back to Argentina never occurred though as her remarkable scientific career took off. As a member of the Department of Histochemistry at the Hammersmith Hospital, Dame Pollock developed immunocytochemical techniques to identify and localize the production of peptide hormones at the cellular level. By the early 1990s, she had been promoted to professor and chair of the Hammersmith Hospital, Department of Histochemistry, and refocused her research on nitric oxide regulation of normal and diseased states, particularly this molecule's role in bone and lung tissue. In a bizarre life twist, Dame Pollock was diagnosed with pulmonary hypertension, one of the diseases she was studying, requiring her to undergo a life-saving heart and lung transplant in 1995. This experience on the care-receiving side of the doctor-patient relationship spurred her into a new field, the field of tissue regeneration and engineering. The lack of appropriate donor organs for patient transplant led her to investigate new solutions that utilize our own cells to generate needed tissues and organs, work that she continues to this day. Since 1997, she has served as professor and director of the Tissue Engineering and Regenerative Medicine Center at Imperial College London, overseeing a diverse group of researchers in areas such as biomaterial science and stem cell research. This work has generated a number of patents and resulted in the establishment of the biotech company Novathera to develop and commercialize the center's discoveries. The extent of Dame Pollock's research accomplishments is evidenced by her approximately 1,000 published papers, positioning her as one of the most published and also cited scientists of the last two decades, also by her appointment to numerous editorial boards, and by the international recognition and awards she has garnered from her professional colleagues in pathology and endocrinology, culminating in her receipt of that title, Dame Commander of the British Empire. Please join me in welcoming Professor Dame Julia Pollock, who will speak to us this morning on her work with stem cells and regenerative medicine. Thank you, and thank you ladies and gentlemen, and thank you for the invitation to see these wonderful autumn colors of your country. It's really very, very nice, but I really didn't expect to talk to a few 5,000 people. I thought I was coming to give a lecture of 50 or 70 people, but the most surprising event was the prior to my lecture, a jazz band. It never happened to me. I'd like to tell you a bit about what we do at Imperial College, and the work on tissue engineering and regenerative medicine. I think I'm doing the right thing. So Imperial College is located in quite a trendy area of London. So if you are coming to visit London, try to avoid it because it's horribly expensive. But Imperial College is in an area where Prince Albert, the Prince Concert Queen Victoria, wanted to develop science and arts in that area. And they developed, they showed a tower, a queen tower, that you can see depicted here. And this has a preservation order, so it cannot be built. So Imperial College was built all around the tower. And it's located in a nice area where the Albert Hall is. And in summer there are the summer concerts, which the area of the grand floor is the promenade concert. They remove the seats and all the young people are standing there cheering, listening to the most wonderful classical music. And there are a number of associated hospitals that are part of Imperial College. So what is regenerative medicine? Well, it's really, they have many terms, like tissue engineering, biomedical engineering, bioengineering. And it's the application of the principles and methods of life sciences, medicine and engineering, toward the development of biological substitutes to restore, maintain and improve body functions. So what is not regenerative medicine? I wish it would be, but it's not. This is me, and it's not Ida, as my children already are preparing for inheritance money. And it's not what the papers wanted us to believe, that it's in the air, on the back of a mouse. So really what it is, it is about living a long healthy life for everybody, if we can repair damaged tissue. And in fact, it's divided into several segments, which I will go through in the lecture. But if we are able to create a tissue in a test tube, with the aid of specially designed materials and cells, we can have tissue engineering. We can also use cells differentiated into a particular lineage to cure a particular disease organ by the name of cell therapy, or we can stimulate the regeneration of our own body. So it's helping the body to heal itself, so we can replace by tissue engineering if we are able to create an organ in a test tube using cells and materials, as illustrated here. Or we can have cells prepared in a test tube that will be able to regenerate a particular organ of the body. Or we can stimulate cells which are in our body, stem cells in our body, that will tend to go to the sides of injury. And we can then, if we learn what are the chemicals that these cells contain that allows regeneration, maybe one day we will have a regenerative pill. We'll tell the patient, take this, and your lungs will regenerate. I don't think it'll be my lifetime, but it may happen. But it is possible to regenerate because other mammals and other species can regenerate. And what's happening? Have we lost the genes that these animals have? For instance, a deer can regenerate easily when it breaks, or other animals. Or we have containing in our body genes that they are suppressing our ability to regenerate. But in order to succeed, regenerative medicine has to combine. We need to come out of our boxes and collaborate between cell biologists, material scientists, geneticists, and all others because we need to learn how from one cell we become one individual. So it's needed because we need to create good health and wealth. And by doing so, perhaps one day we could have aging, the natural aging, but not in an unpleasant way like osteoporosis or Alzheimer's disease or unable to hear or to see. Nobody is extending life, but to make it very pleasant and painless. Or trauma. We can really help to regenerate. And of course we lost the champion of regeneration with a continuous with a real urban research center. So there are a medium, every disease you can think of could help by this field in the future. Just a few examples, a smoker's lung, or a heart attack, or damaged liver, or many others. And we need that because in many terminal diseases, organ transplantation is the only solution. And there are no sufficient number of organs. Every 18 minutes there is the need for an organ and most of the patients that need an organ will die before they get a chance. And we need to create cutting in the healthcare and commercialize and we will have wealth and health in the country. So we move to different stages of regenerative medicine. We need to learn which is the best cell source, how we encourage the differentiation to a different lineage, to a different tissue type, how we get sufficient number of cells, how we combine with materials, how can we expand the cells that we have them in a petri dish, how we know that these cells perform the function that we are hoping they will perform, how we develop appropriate animal models to test, and how we move to clinical trials. So, although this looks very simple that can be done by tomorrow, we face mega challenges in every single aspect of regenerative medicine. We need to do more and more research. But we are getting there, as I'll show you later on. So what are the challenges we have on the cell type which will be the most appropriate? So first we need to decide which cell we want to use. So, if we want to use a stem cell, a stem cell is a cell that divides and produce another stem cell. So we have the ability to have stem cells in our body to regenerate and the sister cell will be of the type of tissue. For instance, if we cut our skin, we can heal, obviously we can regenerate, a baby will leave no scars, the older we get we have more protracted regeneration, but it is due to the fact that we have stem cells in our skin and the cell needs to remain as a stem cell and divide to make a skin cell. So the older we get we lose more and more of the stem cells, so the ability to regenerate when we age is more protracted. So we can have within the stem cells the famous or infamous embryonic stem cells and we can have other cells which are a little bit mature within the development like there are plenty of cells in the bone marrow stem cells and be like a cord of a good source of stem cells. There are niche specific like I explained to you in the skin and every organ fat has a number of cells. Do we know which best? No. Nobody has done a systematic study comparing in a single identical circumstances different cell types. It's a mega study, should be done, but it hasn't been done as yet. In terms of human embryonic stem cells, these cells come from the very early embryo on the program of in vitro fertilization and in the UK once it's a successful fertilization the eggs are stored but they cannot be stored for more than eight years. After eight years when they are frozen and it was implanted and the family has the family two or three children or whatever they want they are asked whether this, the rest can be destroyed, they cannot be kept forever or they can be used for research and if the patient doesn't want to allow research they are destroyed so one way or the other these very early embryos are destroyed. In the UK we can use imported cells, we can derive embryonic stem cells and the license and the ethical approval, we can use therapeutic cloning and the license and reproductive cloning is illegal, is a criminal offence. So where are the cells? Any cell from the development can be used. Here is depicted a fallopian tube and on day four there is a collection of cells and on day five between four and five a little cell is taken for the prenatal genetic diagnosis routinely and you must have read in this country the work of Robert Lanza that is able to derive embryonic stem cells from there. Normally they are obtained a little later on of the pre-implantation, these are the kind of implanted from the inner cell mass on day six. And then continues, so you have a fertilized egg, then a totipotent stem cell will produce even placenta, these are to use for in vitro fertilization but not for human cloning, it cannot be done, it's forbidden, then when it's a hollow ball of cells, the blastocyst, cells can be obtained and the embryonic stem cells, when they continue the development they become a little bit more differentiated than like the cells in the bone marrow and then totally differentiated like a neural cell, so the examples are illustrated there. So from the bone marrow plenty of stem cells that are not embryonic are obtained and transplantation is routine clinical procedure for blood disorders. So this may be the best cell for clinical applications in the early days, then when we learn more about embryonic stem cells that could be done later on. Ambilical cord contain a burst of embryonic stem cells and this can also be used for regenerative medicine, fat tissue which is not an ethical to take and at least in the UK. And cells are located in each organ as I explained to you about the skin. So again we don't know the stem cells, the adult stem cells from the bone marrow or the tissue, it's useful because transplantation is in routine clinical practice, it's from the same person, so are autologous, they will not produce tumors and there are clinical trials, but they have a more limited development, they are in low numbers and they all get even less and compared with embryonic, these cells can produce all cell types, they can self renew, they can easily be available and grow very rapidly, but if you implant these undifferentiated cells, you can produce a malignant tumor, so they have to be differentiated, it's dangerous, there are huge clinical hurdles, there are ethical problems that the world yet has not settled down and because they are not from the same patient can produce rejection and immune rejection. The niche specific can be from the same person, they will not produce tumors, have a limited development, they are sometimes difficult to access, to access stem cells from the brain to operate the patient, take a bit of the brain and then put it back, maybe quite difficult and they are present in low number. Once we have the cells, we need to learn how we differentiate the cells for the tissue we are interested in and there are normally the embryonic stem cells will tend to differentiate spontaneously into different types, but to coach them to a particular lineage, one needs to do experiments and it could be by giving growth factors to the soup where you are having your cells in the dish and other ways which I'll go through. So using that at Imperial College we were able to obtain pieces of bone both from mouse embryonic stem cells and from human embryonic stem cells and we were able to characterize the little pieces of bone and we were able to obtain peripheral lung cells. There are two types of peripheral lung cells, one that is called type 2, that one can use a marker to distinguish and these cells can give rise to the type 1 cells which are flat and they are in contact with the blood vessels and they produce gas exchange and these pluripotent embryonic stem cells can give rise to these cells which ultimately will be functioning type 1 cells able to gas exchange because we have the marker. There are other tricks that one can do, this is an illustration, we can permeabilize the membrane and then we culture with for instance lung extracts if we are interested in lung or any other extract then we reseal the membrane and we can obtain differentiated cells and doing so we are able to obtain a shorter time differentiation because these procedures are cumbersome and take a long time and it does not produce a pure large amount of desired cell types but we are getting slowly there by having 17 days instead of 33 a little larger yield like we were having before. So can we introduce a collection of precursor cells, young cells but not pluripotent and allow the microenvironment to do the job that we want in the body. So there is an interesting aspect, we co-culture, we put it in a dish, in a petri dish pluripotent embryonic stem cells with pieces of lung and the cells became lung by contrast if we put it with cartilage the cells became cartilage so the microenvironment obviously is playing an important role here is a diagrammatic illustration how we can unwrap the cells with the tissue we are interested for instance in this case was lung and then we see whether the cells differentiate and this could be very relevant for cell therapy maybe we don't need to struggle to produce a whole organ to repair somebody's damaged tissue maybe if we have the cells to worse a differentiation pathway then allow the microenvironment to do the job for us but we still have a mixture of cells when we are in a petri dish so how can we have pure cells how we can have a collection of cells and we can use markers if the markers are on the surface of the cells if it's a protein on the surface of the cell we can label it with the color and with the machine we can pull them out and have a collection so we have to have a specific surface marker and it's non-invasive at real time and it's called fluorescent activated cell sorting to purify the cells prior to implantation we need also materials so cell biologists alone can provide certain degree of contribution but not the entirety and why we need materials we need them for carriers if we are going to do cell therapy or providing tissue engineering per se an organ in a test tube so these materials are combined with the cells this is a three-dimensional scaffold with the cells and eventually can be implanted into a living organism and we have enormous amount of materials and of course Dr. Jennifer West is a world expert on that so I'm only a cell biologist but there is a great quantity of very suitable materials this is one bioglass created by your fellow countryman Professor Larry Hench and creates an interfacial bone between implant and host tissue and it was important to know what were the molecular events that took place in the cells the cells needs to attach to the material sometimes they repel so had to be man-made material but they need to attach they need to grow nicely and demonstrate that with the material they grow better like demonstrated here they need to differentiate the lineage you are interested in in this case was bone lineage and it can be done three-dimensionally to have a little three-dimensional organ in a petri dish so three-dimension configuration to regenerate the tissue material should stimulate cell growth and differentiation attachment the position of extracellular matrix act as a template for tissue growth for implantation be reservable one doesn't want it all the time for pharma be insoluble because we can test drugs in a petri dish and here we can test for pharma bioterrorists household chemicals a variety if we have a three-dimensional composite of cells and materials in a petri dish but we still are struggling with a number of cells even if we beautify even if we have put them with the material we need to bulk up the number of cells in a three-dimensional configuration so we need to use machines that will permit fluids to come in because if you grow the cells without nutrients the middle will die so we need to rotate them we need to introduce fluids we need to monitor what is happening so this is another aspect of the research so one illustration is to be ready for preclinical applications so here is an illustration that these pluripotent embryonic stem cells if they are conditioned in a special way by grown for a short period of time with a particular medium they will produce lots of bone if the cells are cultured for a bit longer with the same misotherm medium they will produce heart we can have customized lineages which will be very useful for cell therapy but ideally we want to have a closed system that is fully automated where we encapsulate the cells and we put them in there and we will have control, reproducibility, automation, validation and safety and it won't have the handling the human error it will be fully automated machine and we will have a non-invasive sensor that will tell us the amount of sugar we have there the amount of metabolites, the amount of oxygen whether we need to put more or less and they will be very useful for three dimensional constructs and to use for clinical application I seem to talk like this and it comes but it never mind and an illustration is putting pluripotent stem cells encapsulated in a bead, in a little bead and then you can differentiate it into bone you put it in this rotating bioreactor and you get lots and lots and lots of bone nodules and ideally you want to have a closed system that you can give to the clinic and they can treat a heart patient or a bone fracture or whatever is the clinical need so another illustration, cells maintain their pluripotency when they are encapsulated and the alginate beads are biocompatible, FDA approved, can be soluble and injectable and they maintain their pluripotency for at least 116 days and here it shows how the cells are alive because we are giving nutrients so the cells are alive and they stay undifferentiated then you take them out of the bead and they are still undifferentiated then you can put differentiated factors to have large collection of cells so how do we move from all this experimental work to preclinical phase the animal models where there is good variety of very reliable models we put embryonic stem cells into animals which didn't have an immune system and we were able to produce bone pieces of bone and others are doing different animal models so we need purification to homogeneity, we need to characterize the cells we need to see that genetically they are normal and they are good for clinical applications and the animal models will provide us to analyze the cell fate and engrassment and how they are functioning in bed before we go to clinical applications and illustration is an animal model for regenerative medicine for cardiac disease the heart was injured by ligation of the coronary artery and the stem cells allegedly because it's very controversial were able to repair the heart muscle so currently at Imperial we are trying to repair lungs and we characterize the cells as peripheral lung cells by various means including protein expression and gene expression and then we see that the cells become flattened and they are in contact with blood vessels because they are exchanging gas and on this we publish the series of papers and now currently we are putting them on animal models of major septicemia or smoking lungs to see whether the cells will repair currently we mark the cells with a substance that we can visualize we see they go to the lung and now we need to find out whether they perform a function in the lung before moving to appropriate clinical trials there are clinical trials, early clinical trials were a proof of concept that putting bone marrow stem cells can correct children brittle bone disease or they can correct heart failure or they have engineered skin as early clinical trials but the criteria should be robust, we need to use large numbers double blind randomize we don't need to know to avoid bias and it needs to be confirmed by many other workers but then feel this moving, when I am asked when do you think we will have an organ in a dish I used to say well it will take another five or six years but now you see recently Tony Attala produced functioning bladders for children and lasted for eight years so we are moving faster than I would have thought so the field of stem cells, tissue engineering, gene therapy, nanotechnology are all converging to produce clinical applications to cure human beings so a revolutionary medical discipline with enormous implications for therapy and economic impact I think the future is here but I don't see it but I hope it will be seen soon so Imperial College is very multidisciplinary with enormous amount of departments during different aspects of regenerative medicine my own little team contributes with cell biology thank you


Hi there. Thanks very much, welcome to the talk. I'm not very good at intros, and I always talk under different pseudonyms, so I'm just going to tell you some facts about myself to hopefully make you trust what I'm about to tell you. I've been mainly working in embedded systems slash enterprise perimeter for a few years. Sometimes as a consultant, sometimes as a researcher, sometimes in education. I've published research into Microsoft, Cisco, Netgear stuff, all kinds of different software over the years. I spoke here a few years ago about cellular hotspots and things like that. My main interest is just reverse engineering, so we might go off on a bit of a tangent here in some of these. I'm going to have to speed through some of this because I've got a lot to talk about, and this is one of the bits I'm going to speed through. If you don't know what PBX is, a PBX is a private branch exchange emphasis on the private. Before these private branch exchanges, everything went through public branch exchanges for telephone calls. The problem was when businesses wanted to make calls to each other internally, the calls had to go through a public exchange, so it cost them money, so they moved the branch exchanges indoors. These first early PBX systems were for classic phones, and then VoIP started becoming more cheaper and more popular, so digital PBX started popping up, starting off as hardware and then slowly over time becoming implemented purely in software. Then, as time went on communication styles started morphing again, so PBX started morphing into something that people start to call unified communication servers today, which is for like video, text and all kinds of other kinds of communication, so this is more like modern chat based contemporary stuff, but I'll use the term PBX more here, because the servers and the software that I'm talking about is more like PBX servers, they're not really unified communication servers, although they do function in the way that unified communication servers claim to as well. This kind of stuff shows up in enterprise environments where they like to do things like on-prem, and there's a lot of different stuff in the PBX slash UC space, so probably the most fundamental will be like the SIP switching telephony software, something like asterisk or free switch for example, this is like the bare bones telephone exchange functionality, then there's other products which show up which use these phone exchange cores and then provide easier UI configuration, so for example free PBX is basically just like a UI configuration wrapper for asterisk, and SIP XCOM is basically a UI configuration wrapper for free switch, and then on top of that they'll bolt a whole bunch of other stuff on text and video chat to make it a bit more UC like asterisk. There's a few big like PBX systems, free PBX and 3CX are probably the biggest, and then there's SIP XCOM as well. There's about 10,000 to 19,000 free PBX web interfaces I could see on showdown the other day, about 250,000 3CX ones. There's not so many SIP XCOM ones, but it has been around for quite a long time, so it's still working into. PBX servers are due to the complexity and all the kinds of services that you find on them, they can have a really big attack surface as well, so they'll have things like the SIP, like telephone exchange core, they'll have proprietary services like the inter-asterisk exchange protocol, which you find an asterisk. There's things like MGCP, RTSP, XMPP, MySQL, DNS, all kinds of stuff you'll find on these servers, so there's a lot to look into. There's also these like web management interfaces, which are the core of a lot of these things, so as I said before, free PBX is basically just a web UI that allows you to configure all of these extra services plus asterisk and things like that. All of these servers also require authentication user accounts, so post authentication stuff is also on the table for this kind of research, so the attack surface is really, really broad. I'm going to talk about two different servers today. The first one will be SIPXCOM and the other one will be free PBX. I there's a caveat to it, which is that I found these bugs through sort of less structured research, so despite the massive attack surface, I only managed to sort of really touch the surface of what actually is on these servers, but what I found I think is quite interesting. So the first bug is an RCE chain in SIPXCOM, so SIPXCOM is mainly written in Java. It's all open source, all on GitHub. It ships with this optional XMPP server called SIPX OpenFire. The name is based on Ignite OpenFire, but the bugs don't actually affect Ignite OpenFire. It's a quite complex SIPX OpenFire is quite complex integration with other like SIPX components, so it's not a totally standalone XMPP server. It sort of integrates with the whole SIPX ecosystem. Within SIPX OpenFire there's a message interceptor called default message packet interceptor, and every message that's sent through the XMPP server is checked by this interceptor to see if it starts with a string that they call directives internally. So these directives are at call, at conf, and at xfer. If the message starts in one of these directives, then that message is handed off to some other SIPX component, so this is part of the whole integration. The issues sort of affect a couple of the directives, but I'm just going to follow the at call one just for the simplicity here. So every message is intercepted and then passed to a function called process chat message, where it's checked for directives. If it starts with at call, then the rest of the message is passed to the map arbitrary name to SIP endpoint function, and then the result of that is passed to send rest request. So we can just follow this flow really quickly. Map arbitrary name to SIP endpoint just checks for usernames in the string and basically just returns back the string wholesale as we want it. As we give it without doing anything to it if it doesn't find a valid username. Build rest call command takes the whole string that we've passed in the string. It can catch it directly into a URL string and then returns it, and there's no check or filtering on it at all. And then that whole URL string is passed to send rest request, which just can catch it directly into a curl command string. And this curl command string just gets passed directly to runtime.exec. There's a to do note above this function saying, suggesting that they know this isn't really the ideal to implement this functionality, but it's been there since about 2010 according to the githistory, so 13 years of not doing anything about it. The conventional wisdom of this would say that this is just arbitrary command execution, but that's not actually really true. Runtime.exec doesn't quite work like that. There's an assumption that runtime.exec for some reason behaves like system p open, which is not true at all, so all the kind of classic code execution payloads that we might want to use for this will always fail. Just to give a quick run down of how runtime.exec works, we'll just follow the source. If you pass a normal string directly to runtime.exec, the first overload we hit is the one that just takes a single string. This passes it to another exact overload which takes three arguments, the first of which is a string. That overload takes the string and passes it to a string tokeniser and then just pushes that into a string array which passes it to another exact overload which takes three arguments and then arrays its first argument and then this overload passes the string array to process builder and creates the process using .start, so we've got this array of strings passed to process builder. Process builder takes the first element in the array and checks its executability and then the array gets passed to process .start, which just in our case because we're running on Linux creates a unix process. The first element of the array is the executable argument to the unix process. Regardless of what we actually inject into this command string, we're always going to be running curl, so there's no way around it. So it is we don't have direct command execution but we do, we can kind of use this to our advantage so we can't control the executable it's always going to be curl but we can pass arbitrary arguments to curl. So the next question is what arguments can we pass to create a useful primitive there? Before we figure that out we have to look at how the command string is actually laid out on what we control, so we can't control the arguments at the beginning because they are hard coded but as long as we pass a string that contains spaces we can put whatever arguments we want later into the command. So for example we can download files within the same curl command by just adding an extra dash x get argument and specifying just a file to output to with the OFLAG. So it's a pretty useful primitive we can force the server to download files from anywhere and save them and CipexOpenFile runs as the daemon user so we can only really write where the daemon user can write that's the only real limitation on it. We can also read files from the server so we can use the dflag to read a file on the server then send it over to wherever we specify so an injection like this one tells the first x dash x post request to output the result of the request to some temp file and then tells curl to read the password file using the dflag and then send it over to an IP address. So we can both read and write files using this curl argument injection so they're quite interesting and good primitives but it doesn't quite get us to code execution directly. But there is one more bug which is quite useful in this case. The OpenFile service file for CipexOpenFile is installed with daemon daemon privileges in the init.d directory so with our right primitive we can overwrite this file which will execute as root whenever the service is restarted. So we can chain those things together and we overwrite the OpenFile init file using the curl file download primitive and then replace it with an almost identical file with just a command exact payload on it. We wait for the service to be restarted or force it to restart using the web interface and then we just get a root shell. So it's a fun bug chain just by sending XMPP messages from one user to another you can overwrite files and then eventually get a root shell from this server. There's a full rundown of the exploit on setlist that I sent over in March that you can have a look at. CipexOpenFile is maintained by a company called CoreDial who just never responded to anything that I've said so I sent them emails for a while I first reported in November they didn't reply I kept on sending emails for a while they didn't reply to any of them I kept sending them tweets and they just kept on untagging themselves from tweets so I consider that a kind of vendor response of active indifference and so these are just bugs that are still in the latest version of CipexCom and I guess we'll stay there for a while it looks like CipexCom might be dead I'm not entirely sure so yeah, CoreDial gets half a star for their vendor response very bad experience don't work with them ok, the next bugs are all in freePBX so freePBX is maintained by Sangoma is based on asterisk for the telephone side of things there's a web interface loads of free and paid modules that you can sort of strap on to it and according to their website they run a bug bounty program so they say they want to work with security researchers that they want to fix everything within 60 days so that all looks really nice and of course at this point I'm really looking forward to the professional disclosure process with lots of communication and very happy outcomes for everyone involved CipexCom is pretty straightforward it's just straightforward open source Java, freePBX is a bit more complicated so it's mainly written in PHP which is nice a lot of the core code is open source to some extent there's a freePBX core bit that's free and the code for that's all in the freePBX bitbuck here there's a few free plugins which come bundled with freePBX which you can't find the source for for some reason and then Sangoma also sells licenses for some other plugins and none of those plugins are open source either so there's a lot of functionality where the code just isn't public despite the fact that freePBX is touted as something like an open source pbx server it's mainly written in PHP and it's shipped mainly as a Linux VM so whoever has access to the VM could read the PHP files so obviously to avoid leaking code for the non open source components they've used something called IonCube so IonCube is a PHP source code obfuscation solution the IonCube compiler compiles down PHP to Zen bytecode essentially and stores it in its proprietary IonCube format and then at runtime the PHP process loads the IonCube module which decompiles the PHP before running it so it's a massive oversimplification of actually what IonCube is doing but it's essentially what it does it's a lot like things like Zengard and Source Guardian there's some really nice previous research into IonCube by these guys that I've mentioned here but it's from quite a few years ago so some of the information is still relevant some of it's a little bit updated the point of IonCube is just to create as much hassle as possible for people like us so anyone who wants to have a look at the source code it will cause us to spend a lot of time trying to get access to the source or maybe just give up entirely and the point is also to make money like they sell a license for like $200, $229 there's no free or open source deobfuscators available I'm not entirely sure why I assume it's because IonCube are litigious I'm not entirely sure how legal it is or how legal it would be to offer a deobfuscator for free but regardless because there's nothing free out there there's this grey market for deobfuscation tools that exists out there so you can find these deobfuscations as a service and people trying to sell things on telegram and very dodgy looking YouTube videos that show nothing in particular happening with very big price tags so I spent a bit of time playing with these during the process of looking at the free PBX code I did actually I had a look at some of the I did get some useful code out of out of some of them but it's a bit of a grey area regardless I spent quite a lot of time looking at the deobfuscation process so I'm going to share a little bit of that today as well in the case of free PBX they're using the R&Q loader for PHP 7.4 which is version 10.4.5 the loader PHP module is an SO that's just under 1.4 megabytes it's part of the free PBX VM image so you can just dump it straight out of there it hooks a Zen compile file and Zen execute X functions in the main PHP process what it does very basically at the beginning is just check for magic bytes at the start of every PHP file that comes in if it finds them it will try to deobfuscate it and run it, if it doesn't find it it just passes the files just directly back to the PHP Zen VM if it does find the bytes then it will it goes on this sort of chaotic journey so the whole loader is a complete chaotic mess you have to really follow a lot of things going along it doesn't just deobfuscate the Zen byte code and just pass it back to the main PHP Zen VM it actually ships a whole modified Zen VM within itself and every opcode is executed within the loader itself nothing ever goes back to the main PHP process so the whole extension is really really big and you can waste a lot of time in it I'm just going to share a few little bits and pieces that I that I noticed while I was working on it the loader is kind of obfuscated so all the strings or the useful strings within an x-word with this static x-word key so obviously when you're trying to reverse engineer it being able to see the strings is very beneficial as part of the process so I wrote a gridra script which you can download here to help you do that you do need to you do need to put the x-word key into it for the specific loader although I think it might be static among different versions but I have to see and once all the strings are deobfuscated it makes it very obvious as you can probably see and maybe see in these little images here where the Zen VM code is just copied and pasted you just see the exact same strings from the Zen VM except weirdly obfuscated within the loader itself so it makes it a bit easier to see which bits are just Zen VM and which bits are actually IonCube there's also a bunch of other weird little stuff in there, there's something called IonCube24 which is end point security for PHP or something, I'm not entirely sure what it does but it just registers lots of IC24 underscore PHP functions in there knowing that there's something that isn't really relevant in there as useful as well it means we can just sort of cut through the fat a little bit it registers a bunch of underscore IonCube PHP functions as well but it also registers these other strange functions that looks like with names like some sort of mash the keyboard each of these functions takes two arguments one of just is a pointer and the other is a kind of checksum which is just that same pointer exord with this with this number if you don't give it the right arguments it will just send you some really sinister threats it will say things like a rat who knows that a cat's tail invites destruction and do good reap good, do evil, reap evil and things like that which isn't very isn't very nice but if you give it the right arguments it will do something I never actually figured out exactly what it was doing but it seems like some kind of debug functionality and there maybe it would be a fun thing to look at another day so once all of this is sort of sifted through and we've cut through a lot of the fat the way to start de-office gating this stuff is to hook some strategic points in the unpacking process and you can dump the opcodes in this sort of proprietary way that they've stored them you might be able to see here with these these very strange looking strings but it stores the variable names it stores the function names like everything is retrievable from within the compiled IonCube format whatever it is anyway it's a whole hassle and it's a whole thing to talk about another day but it's elaborate and complicated and you have to spend a lot of time in it I'll talk about it probably another day and maybe talk to legal professionals about why this kind of stuff isn't in public anyway at the moment anyway we have de-office gated code why does FreePBX use this obfice gated code in the first place? I'm not entirely sure I think it has something to do with the license model so they've got all these paid modules and the paid modules check for licenses before they run but since it's all PHP if the code wasn't obfice gated somehow then maybe people would modify the code and then bypass the license checks but it does sort of serve a licensing purpose maybe the only problem with this logic is that once you've de-office gated this stuff you can just replace these obfice gated files with the de-office gated ones and FreePBX won't notice and you can comment out the code it doesn't check for integrity or anything like that it does check for integrity on other files that aren't obfice gated which is also very strange so they've decided to do obfice gation instead of integrity checking which I don't really understand maybe you get a sense by now I think obfice gation is really silly anyway so let's look at some bugs the first one is in the de-phone API component this is part of the core functionality of FreePBX but the code is still obfice gated for some reason there's a lot of functionality within this but it does require authentication which is handled by this function called de-off de-off contains this subtle if condition which checks if the password is just the word login in the abstract this seems like a weird decision but I think it's because they've designed this API to be a this component to be an API for the Digium or other Sangoma like VoIP phones so these devices aren't expected to have their own credentials so this is a kind of concession in the authentication process for these particular devices to be able to authenticate but it does essentially mean that it's an authentication bypass to pass the logic of this authentication function or two of the things you need is the MAC address of a registered phone VoIP device and this hard coded password login there's also one more check which is the user agent header so you just have to modify the user agent header to look like you're coming from a Digium or Sangoma phone but the whole auth bypass is just sending a packet that makes it look like you're a VoIP device you basically authenticate with just a MAC address and maybe I don't need to tell this audience but MAC addresses are not particularly unique Digium MAC addresses also have this 24-bit prefix so you can find the MAC addresses just by sniffing on the network and then print it on the back of the VoIP devices inside a building or if you're really desperate you could try to brute force the last 24 bits of the MAC address 2 to the power of 24 seconds is like 27 weeks so if you sent a request every second for 27 weeks you'd be able to figure out at least one of the Digium devices on the network and so we have this kind of authentication bypass and we can chain it with this other bug also in the DeFone API the DeFone API handles all these different methods that are specified in this request method field in a JSON post request and so the pbx.users.currentCalls.stopRecordingMethod is one that's vulnerable here so let's have a look so the channel ID function the channel ID value from the JSON request just into a PHP exec function there's no attempt at input filtering or checking anything it's just a very pure classic command injection in PHP in this software in 2023 I'm sorry it's not more interesting than that I'm sorry it's not more complex bug it's just I mean it's fun in the fact that it's just very very classic and very very simple command injection so that's an authentication bypass to ask you chain in free pbx there's another few issues as well this one's another authentication issue in free pbx where they have this admin interface that I tried to avoid finding bugs in because if you actually have admin privileges you can just create a skeleton module and just install it yourself and then you're just running code so it didn't seem like a proper boundary but they do have this other functionality that allows normal users to authenticate the admin interface but they don't get administrative rights I think this is maybe just for monitoring or creating these like lower privileged accounts with this limited functionality they get to see some like module output when they log in and they can be granted access to specific modules and stuff but they're explicitly not given full administration rights but actually it means nothing because anyone who can authenticate to the admin interface has full admin privileges on pretty much anything it's only enforced in the UI so there's no separation between these lower privileged and admin roles in the admin web interface and so we can use this to exploit another vulnerability which is in the API module which any of these non-admin users of the admin interface can access this is part of the core free pvx so this isn't actually obfuscated at all this is just in the bit bucket just in the open source core if we send a request with the command generate docs we hit this like generate documentation function it takes two arguments which we also specify in the request that we're sending it the most obvious issue is that if you can see the code here the host argument is just concated into a string which is passed directly to a process so again this is just a very very bog standard command injection vulnerability the only thing that actually needs to be taken into account when you're exploiting this is the host value needs to actually resolve somewhere so the command injection payload has to start with a valid URL to an actual server that will actually respond but we can just spin up a server and do that so the host will point somewhere like attacker.com slash command injection and then return some valid access token and all the checks will be passed and the command will be run but also because the access token itself that's retrieved is concated into a string we can also just spin up a server that just returns command injections as access tokens and we don't even have to send the command injection as part of the payload we just send a host and we've got a server that's just returning command injection payloads as access tokens so this makes it also quite a fun a fun way to exploit this bug and then finally there's one more little DOS that I found reported to Sangoma it's in another endpoint called UCP which is the user control panel this is accessible to every user by default it's just a UI for normal user functions so making calls managing phone books and extensions and stuff like that it's meant to be for everybody in the UCP PMS module any user can send a request with the command parameter woo del and then this woo del value gets used to create a path which is just passed directly to unlink so we can pass a path traversal string and unlink anything that we want on the server it runs with asterisk user privileges so anything owned by asterisk you can delete on the server so it's a kind of way for any user to delete files useful asterisk files off the server the disclosure the disclosure process with Sangoma was pretty pretty bad as well the response was really lukewarm I sent them a disclosure at the start of May and then they replied a few days later sort of asking about the ion cube stuff and then they never then I sent a few updates and request for information and they never replied and then I chased them with some tweets for a while and I did eventually get a response saying patch some stuff but without telling me or helping me to with version numbers or anything like this so this was about a month ago they I replied to that email from them with a whole bunch of questions and tried to get some other information out of them and they just haven't replied at all so again nothing coming back from Sangoma it was a really annoying situation especially considering they have this big page saying that they really want to work with security researchers and they really want to try and fix vulnerabilities as quickly as possible and that's also why none of these issues have CVs related to them at all and the one email they did send back to me they said that they were going to apply for a CVE for the issues so it might just be that they've decided to apply for one CVE and bundle all of these issues under one CVE which is helpful and useful for all the defenders and customers out there so yeah I sent in these emails they never replied to me I did have a look at the patch for the API bug that I mentioned here and it looks like the patch is now good so I would have also been very happy to tell them that if they'd emailed me back Sangoma gets two stars because they sent me two emails for their vendor response and so I'm going to show oh no how do I do this so this is yesterday I'm not sure why there we go this is the most updated version of FreePBX as you can see here I've taken the session token from the low privilege user and I am sending the patch bypass for the API exploit here and getting a shell back so obviously still issues in FreePBX today I mean I did write a kind of summary for this the PBX systems are meant to be pretty robust they're meant to handle all the communications in these on-prem situations people use them because they want to do things on-prem they want to trust what's happening with their data but the threat model is quite complicated these servers they give different permissions to all kinds of different users there's all kinds of different objects trying to connect to them there's such a massive threat model for them that they're very very difficult to secure the user accounts are often acquired as well many employees will have some kind of phone or chat access many devices need their own accounts and the privilege models are also sort of all over the place as well this extra functionality that they keep on adding to make it more like you see like or voice chat and video chat and things like this text chat and data transfers and stuff is probably an interesting place to start if anyone wants to start looking at these kinds of servers and adding XMPP servers to internal enterprise environments in 2023 seems silly but maybe there's situations where it's called for another take away is there's just command injection bugs in PBX servers in 2023 and loads of them so have fun also trying to look for them also bugs in open source can just sit there for years so the Cipex open fire bug has been sitting there for 13 years and nobody's done anything about it and also Sangoma are really really disappointing to work with they say they wanted to work with researchers they said they had this whole bug bounty program they said they made all these big claims and then they didn't reply to any of my emails so don't trust tenders and also Cod Office Gation is stupid it's fun to try and break it we should all try and break it more this is exactly the kind of place where people should be trying to mess around with that kind of stuff and yeah thank you it's going under here's my email address if you want to contact me yeah thanks