Thanks, that makes sense. Strange that the writeup skipped the most important step in the vulnerability!