I think my S100 is hacked. When trying to login to web gui, I get "ERR_INVALID_REDIRECT" message and after a closer look in developer tools I can see that one of responses from pbx web server is:
data:image/png;base64, ...(base64 encoded image code)...
What would be the proper way to solve this issue?
Is it possible to bring back web gui without factory reset?
Thanks in advance!
While there may be a way, it is probably more complex than the effort of doing a reset and restore. Not knowing what all may have been done other than just reclaiming the web pages, it's a risk that I would not take as they may have done other things to compromise the security of the system that are as of yet unknown. The real question is how did they manage to get to the core files to alter? Was SSH open?
In any event, I can only suggest a reset and restore using a backup that you know to be safe, recheck the firewall and limit all access and once the restore is complete, change all the passwords to the extensions, trunks if using SIP register trunks (to include at the provider as well) web and others. For all you know they may have downloaded the backup and are trying to get past the encryption or simply loading onto another S PBX.
Thanks for all suggestions!
Exactly my thoughts. There are no visible malicious traffic, and all PBX services are working OK. As for the possible point of breach, I can think of couple of ways they could reach the PBX, but considering that no other equipment behind FW has been tampered with, I'm assuming that outdated PBX SW may be one of reasons. Once again, thank you for the response!
Hi Igor,
Do yo open the web access of this S100 for the external? If no, it has low risk to be risked.
The error I could imagine is that there is something wrong where redirect http 80 to https 8088.
Well, would you try to clean the browser cache and login again? If no luck, you may follow Larry's advice.
