Ilevia EVE X1/X5 Server 4.7.18.0.eden - Reverse Rootshell
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
Python script that exploits a command injection vulnerability in Ilevia EVE X1/X5 Server login to overwrite a sudo-allowed script, execute a reverse shell, and restore the original script on exit.
Backdoor review
No backdoor observed in reviewed code
The script is a public exploit for CVE-less Ilevia EVE X1/X5 Server. It sends a command injection payload to a vulnerable login endpoint, which causes the target to execute a reverse shell back to the attacker. The payload and shell handler are standard for a reverse root shell exploit. No concealed backdoor, credential theft, persistence, or unrelated payload targeting the exploit operator was observed.
Classification basis and observed behavior
Classification basis
The script actively exploits a command injection to gain a reverse root shell, which is the definition of an exploit.
exploits/hardware/remote/52437.py:27-32exploits/hardware/remote/52437.py:172-199exploits/hardware/remote/52437.py:80-104Requirements
- Target Ilevia EVE X1/X5 Server with vulnerable login endpoint and writable sudo-allowed script.
exploits/hardware/remote/52437.py:27-32 - Attacker must provide target URL, callback IP, and callback port.
exploits/hardware/remote/52437.py:207-210
Observed behavior
- Starts a listener on the attacker's machine to receive the reverse shell connection.
exploits/hardware/remote/52437.py:80-86 - Sends a crafted HTTP POST request to /ajax/php/login.php with a payload in the passwd field that overwrites a script with a reverse shell command and executes it via sudo.
exploits/hardware/remote/52437.py:172-199 - Upon receiving the reverse shell, verifies the working directory and provides an interactive root shell to the attacker.
exploits/hardware/remote/52437.py:92-104 - On exit, restores the original script by moving a backup file back into place.
exploits/hardware/remote/52437.py:120-131
Behaviors behind the backdoor verdict
Observables
- Reverse Shell
- netcat reverse shell to attacker-controlled IP and portThe payload constructs a command that creates a named pipe, runs /bin/sh with input from the pipe, and pipes output to netcat connecting back to the attacker's IP and port. This is the intended exploit behavior.
exploits/hardware/remote/52437.py:180-197 - Command Injection
- passwd parameter in login POSTThe exploit sends the reverse shell payload inside the passwd field of a POST request to /ajax/php/login.php, exploiting a command injection vulnerability.
exploits/hardware/remote/52437.py:199 - Obfuscation
- hex-encoded byte strings for shell commandsThe payload and cleanup commands are written as hex-encoded byte strings (e.g., \x72\x6d for 'rm'). This is simple obfuscation of the exploit payload, not a hidden backdoor.
exploits/hardware/remote/52437.py:121-130exploits/hardware/remote/52437.py:174-197 - Cleanup
- restores original ilevia_reboot script on exitWhen the operator types 'exit', the script sends commands to remove the modified ilevia_reboot script and restore the backup (.old), cleaning up after the exploit.
exploits/hardware/remote/52437.py:121-131
What the analysis did not establish
- Only the single Python script was reviewed; no external dependencies or network resources were fetched or analyzed.
- The hex-encoded payloads were decoded manually for review, but the review does not execute the code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Linked vulnerabilities
0This PoC is retained in the catalog but is not currently linked to a vulnerability.