Privilege Escalation via argv[0] Manipulation in Tunnelblick

This repository contains a single Metasploit module (modules/exploits/osx/local/setuid_tunnelblick.rb) that exploits a local privilege escalation vulnerability (CVE-2012-3485) in Tunnelblick 3.2.8 on Mac OS X. The exploit targets the setuid 'openvpnstart' binary, which insufficiently validates path names, allowing an attacker with local access to execute arbitrary shell scripts as root. The module works by creating a directory structure and dropping a custom executable payload and a shell script, then triggering the vulnerable binary via a symlink to execute the payload as root. The exploit requires local access to the target, a writable directory (default: /tmp), and the presence of the vulnerable Tunnelblick version. The payload is fully customizable via Metasploit, enabling execution of arbitrary code with root privileges. The repository is structured as a standard Metasploit module and is operational, providing a working privilege escalation exploit for the specified target.