I am interested in demonstrating an attack to my university's security team on IP phones installed at the university. The IP phone models are Siemens optipath410.
nmap, I identified a few IP phones on the network. The IP phone have the following ports open:
telnet (21) and
ssh (22). When I visit
https://IP address, I get the webpage which asks for administrator password. The default password works here.
Now I have full control over all the settings. Is it possible that I can listen to and record conversations? Is it possible to sniff packets on Wireshark and then convert to an audio stream?
Or is possible to perform a man in the middle attack while routing the traffic on my IP and then forwarding it?
This is the main admin page.