LiquidWorm
Source-scoped identity with 748 associated PoCs and 384 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
ExploitDBIlevia EVE X1/X5 Server 4.7.18.0.eden - Reverse Rootshell
ExploitDB exploitPublished 2025-09-16ExploitUnlinked1 file
Analysis
Technical assessment
Python script that exploits a command injection vulnerability in Ilevia EVE X1/X5 Server login to overwrite a sudo-allowed script, execute a reverse shell, and restore the original script on exit.
Backdoor review
No backdoor observed in reviewed code
The script is a public exploit for CVE-less Ilevia EVE X1/X5 Server. It sends a command injection payload to a vulnerable login endpoint, which causes the target to execute a reverse shell back to the attacker. The payload and shell handler are standard for a reverse root shell exploit. No concealed backdoor, credential theft, persistence, or unrelated payload targeting the exploit operator was observed.
ClassificationExploit
Model confidence98%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The script actively exploits a command injection to gain a reverse root shell, which is the definition of an exploit.
exploits/hardware/remote/52437.py:27-32exploits/hardware/remote/52437.py:172-199exploits/hardware/remote/52437.py:80-104Requirements
- Target Ilevia EVE X1/X5 Server with vulnerable login endpoint and writable sudo-allowed script.
exploits/hardware/remote/52437.py:27-32 - Attacker must provide target URL, callback IP, and callback port.
exploits/hardware/remote/52437.py:207-210
Observed behavior
- Starts a listener on the attacker's machine to receive the reverse shell connection.
exploits/hardware/remote/52437.py:80-86 - Sends a crafted HTTP POST request to /ajax/php/login.php with a payload in the passwd field that overwrites a script with a reverse shell command and executes it via sudo.
exploits/hardware/remote/52437.py:172-199 - Upon receiving the reverse shell, verifies the working directory and provides an interactive root shell to the attacker.
exploits/hardware/remote/52437.py:92-104 - On exit, restores the original script by moving a backup file back into place.
exploits/hardware/remote/52437.py:120-131
Behaviors behind the backdoor verdict
Observables
- Reverse Shell
- Payload withheldThe payload constructs a command that creates a named pipe, runs /bin/sh with input from the pipe, and pipes output to netcat connecting back to the attacker's IP and port. This is the intended exploit behavior.
exploits/hardware/remote/52437.py:180-197 - Command Injection
- Payload withheldThe exploit sends the reverse shell payload inside the passwd field of a POST request to /ajax/php/login.php, exploiting a command injection vulnerability.
exploits/hardware/remote/52437.py:199 - Obfuscation
- Payload withheldThe payload and cleanup commands are written as hex-encoded byte strings (e.g., \x72\x6d for 'rm'). This is simple obfuscation of the exploit payload, not a hidden backdoor.
exploits/hardware/remote/52437.py:121-130exploits/hardware/remote/52437.py:174-197 - Cleanup
- Payload withheldWhen the operator types 'exit', the script sends commands to remove the modified ilevia_reboot script and restore the backup (.old), cleaning up after the exploit.
exploits/hardware/remote/52437.py:121-131
What the analysis did not establish
- Only the single Python script was reviewed; no external dependencies or network resources were fetched or analyzed.
- The hex-encoded payloads were decoded manually for review, but the review does not execute the code.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.