⬢ DragonFlyBSD Kernel Audit
DF-0783 / setup_root.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
#!/bin/sh
# DF-0783 full environment setup (root-side, idempotent). Run after a fresh
# reset to noinv-installed. Configures everything needed for the exploit:
#  - load ext2fs
#  - vfs.usermount=1 (persisted)
#  - add maxx to groups 131072 (df0783_a) and 11822 (df0783_b)
#  - make maxx's primary gid = 131072 (so cr_groups[0] byte 2 = 0x02)
#  - remove maxx from operator (so cr_groups[1] becomes 11822, low bytes 0x2e2e)
#  - devfs perms for vn0/md0 (operator group, 660)
#  - install setuid-root ucred_helper
#  - mountpoint /mnt/df0783 chowned to maxx
#  - rebuild ext2fs.ko for the noinv kernel (the shipped one is empty)
set -e

echo "[*] loading ext2fs module..."
if ! kldstat -v 2>&1 | grep -q ext2fs; then
    # Build ext2fs.ko if the module file is empty.
    if [ ! -s /boot/kernel/ext2fs.ko ]; then
        echo "[*] /boot/kernel/ext2fs.ko is empty, building..."
        (cd /usr/src/sys/vfs/ext2fs && make -DNO_INVARIANTS >/tmp/ext2_build.log 2>&1)
        cp /usr/src/sys/vfs/ext2fs/ext2fs.ko /boot/kernel/ext2fs.ko
    fi
    kldload ext2fs
fi
kldstat -v 2>&1 | grep -q ext2fs || { echo "ERROR: ext2fs not loaded"; exit 1; }

echo "[*] enabling vfs.usermount=1..."
sysctl vfs.usermount=1
grep -q "^vfs.usermount=1" /etc/sysctl.conf 2>/dev/null || \
    printf "\n# DF-0783 exploitation setup\nvfs.usermount=1\n" >> /etc/sysctl.conf

echo "[*] configuring maxx groups..."
# Create exploit groups if missing.
pw groupadd df0783_a -g 131072 2>/dev/null || true
pw groupadd df0783_b -g 11822 2>/dev/null || true
# Remove maxx from operator (so 11822 becomes cr_groups[1]).
pw groupmod operator -d maxx 2>/dev/null || true
# Add maxx to exploit groups.
pw groupmod df0783_a -m maxx 2>/dev/null || true
pw groupmod df0783_b -m maxx 2>/dev/null || true
# Make maxx's primary gid = 131072.
pw usermod maxx -g 131072 2>/dev/null || true

echo "[*] configuring devfs permissions..."
cat > /etc/devfs.conf <<EOF
# DF-0783 exploitation setup
perm	vn*	root:operator	660
perm	md*	root:operator	660
EOF
chmod 660 /dev/vn0 /dev/vn1 /dev/vn2 /dev/vn3 /dev/md0 /dev/md0s0 2>/dev/null || true
pw groupmod operator -m maxx 2>/dev/null || true

echo "[*] creating mountpoint..."
mkdir -p /mnt/df0783
chown maxx:131072 /mnt/df0783
chmod 777 /mnt/df0783

echo "[*] installing ucred_helper..."
cc -o /usr/local/sbin/ucred_helper /tmp/ucred_helper.c -lkvm
install -o root -m 4511 /usr/local/sbin/ucred_helper /usr/local/sbin/ucred_helper

echo "[*] setup complete. Verifying..."
echo "  vfs.usermount: $(sysctl -n vfs.usermount)"
echo "  ext2fs loaded: $(kldstat -v 2>&1 | grep -c ext2fs)"
echo "  maxx groups (next login): $(pw usershow maxx | awk -F: '{print $4}')"
echo "  group memberships:"
grep -E "maxx|operator|df0783" /etc/group
echo "  ucred_helper: $(ls -la /usr/local/sbin/ucred_helper 2>&1)"