FOOD FOR THOUGHT Extension to extension calls go to trunks

[Yahdie]

An older system (specs below) when calling extension to extension or when parking calls the call tries to go out the Trunk instead.
Where should I start looking?

PBX in a Flash Version   = 1.7.5.5
FreePB Version          = 2.8.1.5                                 
Running Asterisk Version = Asterisk 1.4.21.2

 

[atsak]

/var/log/asterisk/full

 

[Yahdie]

While digging in "Config Edit" in FreePBX , I came across the following (this system was hacked last week)

extensions_custom.conf
Header
from-internal-custom
custom-count2four
custom-recordme
macro-dumpvars
from-internal

I see this under "from-internal"

[from-internal]; thankuohoh
exten => _.,1,Macro(user-callerid,LIMIT,EXTERNAL,); thankuohoh
exten => _.,n,Set(MOHCLASS=${IF($["${MOHCLASS}"=""]?default:${MOHCLASS})}); thankuohoh
exten => _.,n,Set(_NODEST=); thankuohoh
exten => _.,n,Macro(dialout-trunk,2,${EXTEN},,on); thankuohoh
exten => _.,n,Macro(dialout-trunk,3,${EXTEN},,on); thankuohoh
exten => _.,n,Macro(outisbusy,); thankuohoh

 

[wardmundy]

@Yahdie Have you read this article? You might want to consider moving to Incredible PBX for Wazo.

 

[Yahdie]

Definitely Ward, I'm a big fan of Xivo , however i'm stuck trying to get extension to extension calling working until I can do an upgrade

 

[billsimon]

Definitely Ward, I'm a big fan of Xivo , however i'm stuck trying to get extension to extension calling working until I can do an upgrade

Get rid of that block and reload; then close all web access to your system. Your system is still compromised but without external web access the attackers shouldn't be able to do anything. (Change all your SIP passwords too, to be certain.) Work quickly to get a new system up and running. I have seen this hack a few times and there are sometimes cron jobs that run to "re-hack" the system again later.