DragonFlyBSD Kernel Audit
DF-2663 / stage1_df2663.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2663 stage 1: rebuild tools + base image on a fresh guest.
set -e
mkdir -p /root/poc /mnt/h2
kldload dm 2>/dev/null || true
# tools
cc -O -o /root/poc/diocgtest /root/poc/poc_df2663_diocgtest.c
cc -O -I /usr/src/sys/vfs/hammer2/xxhash -o /root/poc/forge2663 \
   /root/poc/forge2663.c /usr/src/sys/vfs/hammer2/xxhash/xxhash.c
# base image: 256MB, one PFS "leakfs", one 64KB file of random data
dd if=/dev/zero of=/root/poc/base.img bs=1m count=256 status=none
dd if=/dev/zero >> /root/poc/base.img bs=32k count=1 status=none
vnconfig -c vn0 /root/poc/base.img
newfs_hammer2 -L leakfs /dev/vn0 >/dev/null 2>&1
mount -t hammer2 /dev/vn0@leakfs /mnt/h2
dd if=/dev/urandom of=/root/poc/rand64 bs=65536 count=1 status=none
cp /root/poc/rand64 /mnt/h2/leakfile
sync
md5 /mnt/h2/leakfile /root/poc/rand64
umount /mnt/h2
vnconfig -u vn0
md5 /root/poc/base.img
echo STAGE1_OK