The blog author has some other vuln that allows them to make any non-SIP file owned by their user if I understand correctly