Skip to main content
Solved

What is the base path or the 'pwd' that our scripts call from

  • August 19, 2021
  • 3 replies
  • 29 views
W
Forum|alt.badge.img+2

Hey there, I checked the boards but couldn't find a consensus.

 

Does anyone know if custom scripts default to a certain working directory? I ask because I'm trying to gauge the importance of absolute paths when doing binary calls to the "jamf" or "scutil" binaries. If a shell starts in a user's home folder for these scipts, then theoretically if I were to make binaries called "jamf" or "scutil" that did less than helpful things (or daresay even malicious things), would that create a path vuln or does jamf know that aliases are called and defaults to whatever the system is set to previously? I know this all seems moot because the rule is ALWAYS USE ABSOLUTE PATHS, but as a curious mind and a infosec enthusiast I was just curious if Jamf had any protections for that already in place.

 

Anyway, really loving this community of Apple nerds and look forward to the discourse. If this post is completely asinine or naive, I do apologize. I am but a poor script noob and am trying to learn. Thanks in advance. 

Best answer by bartreardon

I ran the following in a policy

 

#!/bin/zsh pwd > /var/tmp/pwd.txt exit 0

 

 and the contents of /var/tmp/pwd.txt was the path to my home directory.

    3 replies

    bartreardon
    Forum|alt.badge.img+9
    • bartreardon
    • Contributor
    • Answer
    • August 20, 2021

    I ran the following in a policy

     

    #!/bin/zsh pwd > /var/tmp/pwd.txt exit 0

     

     and the contents of /var/tmp/pwd.txt was the path to my home directory.

      W
      Forum|alt.badge.img+2
      • williamkeller
      • Author
      • New Contributor
      • August 20, 2021

      I ran the following in a policy

       

      #!/bin/zsh pwd > /var/tmp/pwd.txt exit 0

       

       and the contents of /var/tmp/pwd.txt was the path to my home directory.


      As I had guessed. So it seems if I had an end-user who was clever enough to create binaries with names identical to the ones we call in our scripts then they could ultimately do some damage. 

      bartreardon
      Forum|alt.badge.img+9
      • bartreardon
      • Contributor
      • August 21, 2021

      As I had guessed. So it seems if I had an end-user who was clever enough to create binaries with names identical to the ones we call in our scripts then they could ultimately do some damage. 


      Interesting concept but you would have to modify $PATH for root as that is the context the script runs in. 

      Terms & ConditionsCookie settingsAccessibility statement