#!/bin/bash
set -e

# ── 1. D-Bus system bus ──────────────────────────────────────────────────────
mkdir -p /run/dbus /var/run/dbus /etc/polkit-1/actions
dbus-daemon --system --fork --print-address
sleep 0.5

# ── 2. polkitd ───────────────────────────────────────────────────────────────
POLKITD=$(find /usr/lib /usr/libexec -name "polkitd" -type f -executable 2>/dev/null | head -1)
[ -z "$POLKITD" ] && { echo "[-] polkitd not found"; exit 1; }
"$POLKITD" --no-debug &
sleep 0.5

# ── 3. PackageKit daemon ─────────────────────────────────────────────────────
PKITD=$(find /usr -name "packagekitd" -type f 2>/dev/null | head -1)
[ -z "$PKITD" ] && { echo "[-] packagekitd not found"; exit 1; }
"$PKITD" 2>/dev/null &
sleep 1

echo ""
echo "  System  : $(lsb_release -ds 2>/dev/null || grep PRETTY /etc/os-release | cut -d= -f2 | tr -d '"')"
echo "  PK      : $(pkcon --version 2>/dev/null | head -1)"
echo "  User    : victim (uid=$(id -u victim))"
echo ""

# ── 4. Run exploit ───────────────────────────────────────────────────────────
exec su victim -c "exec /home/victim/cve-2026-41651"