Polycom 8500 config for local CTF

[eldondev]

Hi, I have a polycom 8500 I got off ebay, I would like to add it to a CTF we run at our local infosec meetups in Atlanta. I am having trouble locating the precise config to enable Interactive Connectivity Establishment to make the system a viable target. Current version I am running of the polycom firmware is Cypress 7.2.4.0185 30-Nov-22 13:58. I tried an export of the config, but it is mostly empty. Ideally I would be able to set the property and re-import the config. Attempts to do this so far haven't been successful as far as I can tell.

Sample config export I am trying to modify to enable the flag:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- Application SIP Cypress 7.2.4.0185 30-Nov-22 13:58 -->
<!-- Created 02-01-1970 00:06 -->
<!-- Base profile Generic -->
<PHONE_CONFIG>
        <ALL
                voIpProt.SIP.local.port="1420"
                voIpProt.server.1.address="1.1.1.1"
                voIpProt.server.1.port="5060"
        />
</PHONE_CONFIG>

[eldondev]

Hope it's ok to ping @sfewer-r7

[sfewer-r7]

Hi, so for the HP Poly VVX450 device I had, exporting the settings XML from the device via the web UI, and adding device.feature.nat.ice.enabled="1" then importing it back into the device worked.

I also enabled unencrypted core dumps via:

device.sec.coreDumpEncryption.enabled.set="1"
device.sec.coreDumpEncryption.enabled="0"

which ment any crash then gens a core dump is downloadable from the devices web UI and it wont be encrypted so you can easily load it into gdb-multiarch.

I cant find the PDF specifically for VVX or 8500 devices, but this guide for Edge V devices has some of the config params detailed (https://kaas.hpcloud.hp.com/pdf-public/pdf_12747922_en-US-1.pdf), including ICE (YMMV for an 8500).