rapid7/metasploit-framework — pull request #3305 by claudijd (2014-04-28 01:23:34+00:00)
Title: Adds Cisco SSL VPN Privilege Escalation exploit (CVE-2014-2127)

This allows you to take a level 0 SSL VPN user with clientless VPN access and priv esc to level 15 (admin) on the firewall.

Here's a video that sort of shows this in action with a little context:

https://vimeo.com/93010946

Also, I decided to use the MetaSSH plugin for this because the default SSH handler, which I believe is based on Net::SSH doesn't properly handle Cisco ASA SSH sessions interactively. You'll get get proper auth, but when you revisit the SSH session it doesn't not allow interactive usage, where MetaSSH did.

The SSH handling is not required to exploit or confirm the vuln, but I thought having the an actual interactive shell made it more "fun" to use. I can always pair that back, but I'd like some feedback before I make any additional changes to this.