PHP exec/system/passthru

Discussion in 'PHP' started by grutland, May 27, 2009.

0
  1. #1
    Does any one know of any way of running either of these commands from PHP.
    I want to be able to set permissions on one certain file if they are incorrect.

    This file is set with no way of a user editing it to avoid any security problems.

    Tried using sudo but obviously need to enter a password to be able to use this function.
     
    grutland, May 27, 2009 IP
  2. jestep

    jestep Prominent Member

    Messages:
    3,659
    Likes Received:
    215
    Best Answers:
    19
    Trophy Points:
    330
    #2
    You need to make sure that they are enabled in your php.ini settings. Look for disable_settings and see if they are in there. You calso can't be running in safe mode. Also if you have things like suphp or other security related features, then it may not be possible to use these functions. You have to have write access to the folder that the file is on. If your php is running as an apache module, then it runs as nobody which will make it virtually impossible to execute this without opening up a security hole.

    exec('chmod 755 /home/directory/myfile.extension');
     
    jestep, May 27, 2009 IP
  3. grutland

    grutland Active Member

    Messages:
    86
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    71
    #3
    Safe mode isn't on and not running any other security features.
    What exactly am I looking for?
    Can't find any thing relating to "disable_settings"
     
    grutland, May 27, 2009 IP
  4. grutland

    grutland Active Member

    Messages:
    86
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    71
    #4
    Does any one else have any suggestions?
     
    grutland, May 28, 2009 IP
  5. joebert

    joebert Well-Known Member

    Messages:
    2,150
    Likes Received:
    88
    Best Answers:
    0
    Trophy Points:
    145
    #5
    PHP can only do what the user it ends up running as is allowed to do.
    If this file is setup so nobody can edit it but a superuser, chances are PHP will not be able to edit the file.

    Now, if you wrote an application that you can be executed from the commandline in C[++] or otherwise doesn't need an interpreter, and the only purpose of this application is to make that file permission change, you can setup sudo to allow the PHP user to execute that one single application without a password while keeping it unavailable to everyone else.
     
    joebert, May 29, 2009 IP
  6. grutland

    grutland Active Member

    Messages:
    86
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    71
    #6
    Hmm, that looks like a whole world of pain.

    Is it possible to do this from another approach?
    I know it's possible in IIS to login as the actual user of the server when accessing a certain folder.
    When executing "whoami" I think it returns "wwwdata" or something similar.
    Is it possible when accessing a certain folder (for example: http://www.site.com/admin/restricted/) that it asks me for a username and password, much like .htpswd (speeling may be wrong) would?

    But only to act under this user while using files within this directory.
     
    grutland, May 30, 2009 IP
  7. joebert

    joebert Well-Known Member

    Messages:
    2,150
    Likes Received:
    88
    Best Answers:
    0
    Trophy Points:
    145
    #7
    You can always give the file to the www-data user you seem to have Apache/PHP running as. Any PHP script would be able to modify the file though. If you have a hole somewhere that would allow someone to execute their own PHP, and this file is something sensitive, this could be a problem.
     
    joebert, May 30, 2009 IP