⬢ DragonFlyBSD Kernel Audit
DF-3501 / setup_guest.sh
← back to finding ↓ download raw
#!/bin/sh
# Re-run after every `vm.sh reset with-src`: pushes PoC sources, applies the
# DF-3499 enabler fix (bcopy NULL guard) to the guest's /usr/src copy, and
# rebuilds the patched ng_fec.ko + fecdrive.ko + dumpif.ko.
set -e
CD=dfbsd-qemu
SCP="scp -F $CD/config -o ConnectTimeout=8 -o BatchMode=yes"
SSH=$CD/vm.sh

$SSH run_root 'mkdir -p /root/drv /root/dmp'
$SCP findings/poc/DF-3501/fecdrive.c dfbsd-maxx:/tmp/fecdrive.c
$SCP findings/poc/DF-3499/dumpif.c dfbsd-maxx:/tmp/dumpif.c
$SCP /tmp/opencode/fix_df3499.diff dfbsd-maxx:/tmp/fix_df3499.diff
$SSH run_root 'cp /tmp/fecdrive.c /root/drv/ && printf "KMOD=\tfecdrive\nSRCS=\tfecdrive.c\n\n.include <bsd.kmod.mk>\n" > /root/drv/Makefile
cp /tmp/dumpif.c /root/dmp/ && printf "KMOD=\tdumpif\nSRCS=\tdumpif.c\n\n.include <bsd.kmod.mk>\n" > /root/dmp/Makefile
cd /usr/src/sys/netgraph/fec && patch -s < /tmp/fix_df3499.diff && make 2>&1 | tail -1
cd /root/drv && make 2>&1 | tail -1
cd /root/dmp && make 2>&1 | tail -1
kldload ng_socket; kldload ng_echo; kldload /usr/src/sys/netgraph/fec/ng_fec.ko
kldload /root/dmp/dumpif.ko; kldload /root/drv/fecdrive.ko
kldstat | tail -6'