Skip to content

Commit

Permalink
Typos
Browse files Browse the repository at this point in the history
  • Loading branch information
mebeim committed Jan 26, 2022
1 parent 7dd1bc9 commit e107142
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 7 deletions.
6 changes: 2 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,8 @@ How to:

1. Get a vulnerable version of `pkexec` e.g. from `policykit-1 <= 0.105-31` in
the [Debian repos][polkit-debian] or even built [from source][polkit-source].
You can have it locally installed or just copy get the `pkexec` executable
alone directly in this directory.
You can have it locally installed or just copy the `pkexec` executable alone
directly in this directory (make sure it's executable and setuid root).
2. Ensure you have GCC installed in order to compile the two C helpers in this
repo.
3. Run `./expl.sh` and enjoy.
Expand All @@ -27,8 +27,6 @@ Demo:

![result](terminal.gif)



Cheers, @mebeim :)


Expand Down
6 changes: 3 additions & 3 deletions helper.c
Original file line number Diff line number Diff line change
Expand Up @@ -17,12 +17,12 @@ int main(void) {
// will overwrite envp[0] essentially setting up the GCOV_PATH env var.
"PATH=GCONV_PATH=.",

// A shell that is not be present under /etc/shells, so that
// pkexec's validate_environment_variable() fails, calling g_printerr().
// A shell that is not present under /etc/shells, so that pkexec's
// validate_environment_variable() fails, calling g_printerr().
"SHELL=x",

// An encoding that is not UTF-8, so g_printerr() invokes a loadable
// module (fake_module.c) for string conversion from GCOV_PATH.
// module (fake_module.c) for string conversion from GCONV_PATH.
"CHARSET=UTF-16",
NULL
};
Expand Down

0 comments on commit e107142

Please sign in to comment.