T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/install-startup.sh:4- Finding
User-Writable Script Executed by a Root LaunchDaemon
- Content
View full analysis
ProgramArguments ${SCRIPT_DIR}/restore-root.sh ${TARGET_USER} ``` The documented installation location is within the user's home directory: ```markdown 1. Ensure this skill has been installed to a stable path under `~/.claude/skills/macos-connectivity-restore`. 2. Run `scripts/install-startup.sh`. 3. Confirm these startup items exist: - `/Library/LaunchDaemons/com.joseph.macos-connectivity-restore.root.plist` - `~/Library/LaunchAgents/com.joseph.macos-connectivity-restore.user.plist` ``` ### Technical Analysis The installer creates a system LaunchDaemon whose `ProgramArguments` directly reference `restore-root.sh` in the Skill's existing directory. According to the documented workflow, that directory is under the target user's home directory. System LaunchDaemons execute as root unless another account is explicitly configured. Although the generated LaunchDaemon property list is copied into `/Library/LaunchDaemons`, assigned to `root:wheel`, and given mode `644`, the executable referenced by the property list is not copied into a root-controlled location. The installer only runs `chmod +x` on the original script and does not remove write access from the target user or verify that the script and all parent directories are owned and controlled by root. As a result, the target user—or malware already executing as that user—can replace or modify `restore-root.sh` after the administrator approves installation. When the LaunchDaemon subsequently starts, it executes the modified script with root pri ...[truncated 1914 chars]- Remediation
View remediation