Cracking SIP digest passwords

Original post From November 2015

I needed to check if SIP passwords that was provisioned on a device was correct, using just wireshark traces to get the different values that was sent between the device and the server.

SIP uses MD5 Digest Authentication, where the password never crosses the wire in clear text. Rather, the password is hashed together with other values, and then the server compares the hash to its own hash computation, to see if they are the same. If they are, then the device must have the correct password.

When a device tries to REGISTER, the server will challenge it with a nonce. The nonce is a one-time key, meant to prevent replay attacks. The device then needs to compute with following:

HA1 = MD5(“myusername:asterisk:password”) HA2 = MD5(“REGISTER:sip:sip.example.com”) response = MD5(HA1+”:40787c47:”+HA2);
The device will send the response value to the server for comparison.

In my case, to make sure that the hashes were computed correctly, I checked them like this:

yusufmayet@yusuf-HP-Desktop:~$ echo -n "45345:realm.com:5435" | md5sum
d1c23d485345435e4c9c0bf63  -

Which gave me HA1

yusufmayet@yusuf-HP-Desktop:~$ echo -n "REGISTER:sip:test.co.za:5060" | md5sum
4f20c9ab63453457e44696a3  -

Which gave me HA2

yusufmayet@yusuf-HP-Desktop:~$ echo -n "d1c23d485345435e4c9c0bf63:2d6eb162513045769f23705546gf
0000005297058d:4f20c9ab63453457e44696a3" | md5sum

2263f03dd182ff0c799c97a3c581e534  -

Which gave me response

I could then compare the response values to make sure that it matches, and therefore the correct password was used.

Another way it to this node application to calculate the password, based on the above values. Once you have node.js installed, simply calling this app with node and the correct values, will generate the password. In my case, because the password contained numbers, I had to include numbers in the lower_case array in the application code.