T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/notify.sh:40- Finding
Undocumented Process and GUI Window Reconnaissance
- Content
View full analysis
/dev/null | tr -d ' ') if [ -z "$_pid" ] || [ "$_pid" = "0" ] || [ "$_pid" = "1" ]; then break; fi _ancestors="${_ancestors:+$_ancestors,}$_pid" done # Detect parent GUI app and front window via System Events (synchronous single call) SOURCE_APP="" if [ -n "$_ancestors" ]; then _wf="${FOCUS_FILE%.focus}.window" _posf="${FOCUS_FILE%.focus}.pos" _result=$(osascript -e "tell application \"System Events\" set pids to {$_ancestors} repeat with p in pids try set proc to first application process whose unix id is p if (background only of proc) is false and (bundle identifier of proc) is not missing value then set _n to name of proc set _w to \"\" set _px to \"\" set _py to \"\" try set _w to name of front window of proc set _pos to position of front window of proc set _px to (item 1 of _pos) as text set _py to (item 2 of _pos) as text end try return _n & \"|\" & _w & \"|\" & _px & \",\" & _py end if end try end repeat end tell" 2>/dev/null) if [ -n "$_result" ]; then SOURCE_APP=$(printf '%s' "${_result%%|*}" | tr -d '\r\n') _rest="${_result#*|}" _win=$(printf '%s' "${_rest%%|*}" | tr -d '\r\n') _pos=$(printf '%s' "${_rest#*|}" | tr -d '\r\n') [ -n "$SOURCE_APP" ] && printf '%s\n' "$SOURCE_APP" > "$FOCUS_FILE" [ -n "$_win" ] && [ ! -f "$_wf" ] && printf '%s\n' "$_win" > "$_wf" [[ "$_pos" == *,* ]] && [ ! -f ...[truncated 4565 chars]- Remediation
View remediation