-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Added exploit for CVE-2017-17106 #13170
Conversation
Co-Authored-By: bcoles <bcoles@gmail.com>
Co-Authored-By: bcoles <bcoles@gmail.com>
Co-Authored-By: bcoles <bcoles@gmail.com>
Co-Authored-By: bcoles <bcoles@gmail.com>
Co-Authored-By: bcoles <bcoles@gmail.com>
Co-Authored-By: bcoles <bcoles@gmail.com>
Tests are failing for the following:
|
@silascutler Looking online to try source this camera. I can see that there are newer models however the one listed as being appears to be out of stock/discontinued: https://zivif.com/product/camera-pr115/. Also I presume you typo'd the CVE number in your description and your module as CVE-2017-171069 is not a valid CVE identifier, however CVE-2017-17106 is and this is the one used in your PR title. Looking around I can't see anyone selling this camera on Amazon and the only people selling the older versions of these cameras I could find was on EBay. Even then the two listings weren't the right model, see https://www.ebay.com/sch/i.html?_from=R40&_nkw=Zivif&_sacat=0&LH_TitleDesc=0&LH_PrefLoc=2. The one I did find, https://www.ebay.com/itm/NEW-Camera-4X-Motorized-Zoom-1080P-Bullet-Outdoor-Indoor-IP-Security-Camera/223546193423?hash=item340c64360f:g:~ygAAOSwo4Vc~ROQ, is available on Amazon for a much cheaper price: https://www.amazon.com/Zivif-PoE-Camera-Motorized-Zoom/dp/B06Y5HGNDQ/ref=sr_1_1?dchild=1&keywords=SCNEW-08530&qid=1587528553&sr=8-1, but it is the wrong model and I'm not sure this would be very helpful for testing. Therefore at the moment it is looking like it will be very hard to source a PR115 camera to perform testing on. If you have any other cameras you have tested this out on and have confirmed that it works on I'd be open to hearing about them as we might be able to test those instead (would still require an update to the documentation to reflect this but at least then we will be able to land this PR and get your work into the framework). |
Thanks for your pull request! Before this can be merged, we need the following documentation for your module: |
Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected. We have been unable to test this module successfully. This may be due to software or hardware requirements we cannot replicate. To help unblock this pull request, please:
Once there's a clear path for testing and evaluating this module, we can progress with this further. |
I think the correct CVE should actually be CVE-2017-17105 - which covers the remote command injection (https://nvd.nist.gov/vuln/detail/CVE-2017-17105).
Yep PR115 is still vulnerable. Also https://www.amazon.com/gp/product/B06Y5VTWC9/ref=ppx_yo_dt_b_search_asin_title?ie=UTF8&psc=1 . I also just ordered https://www.amazon.com/Zivif-PoE-Camera-Motorized-Zoom/dp/B06Y5HGNDQ/ref=sr_1_1?dchild=1&keywords=zivif&qid=1589308250&s=electronics&sr=1-1 to verify on that device as well. The original documentation of the exploit can be found: https://seclists.org/fulldisclosure/2017/Dec/42 |
Hmm can't find any PR115's available online. The first link you posted on Amazon shows that they are out of stock but the second one might be interesting if it is still vulnerable as it seems those are still being sold. |
@silascutler, we won't able to get a camera that can test the module for a while, especially with COVID on the go. Would you be ok to either send us a Packet Capture of the module's successful execution, or hop on a call with myself and Demo it? Eithers good, so whatever suits you best. |
Yes- I'll email you |
Co-authored-by: adamgalway-r7 <adam_galway@rapid7.com>
@silascutler, do you have the module set to executable on your machine? Getting a |
I have the local repo on a shared drive. I think it's not properly preserving the flag |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Updated PR based on feedback.
Removed single space at the end of line 44
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fixed for travis-ci
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good, will land it ASAP. Good work @silascutler 👍
Release NotesThe Zivif Camera iptest.cgi Blind Remote Command Execution module exploits a vulnerability in the Web Interface of Zivif brand IP cameras of version |
Vulnerable Application
Zivif is a brand of consumer IP cameras. Version
2.3.4.2103
and prior are vulnerable to a remote command execution vulnerability - documented inCVE-2017-171069
This module exploits the RCE vulnerability in the web interface of these IP cameras. This is a blind RCE and the results of the command are not returned to the attacker.
Verification
List the steps needed to make sure this thing works
msfconsole
use exploit/unix/http/zivif_ipcheck_exec
set RHOSTS <rhost>
set PAYLOAD cmd/unix/generic
set CMD <command>
exploit
In testing - for validation, the running
reboot
as the issued<command>
is a good way to do a quick validation. Alternatively, usingtelnetd
will start Telnet on the vulnerable device.An example HTTP request from this module is: