6

I was just advised to re-ask my question from https://security.stackexchange.com/questions/72795/command-execution-dvwa-creating-file-in-tmp here.

I use CentOS 7, and I'm trying to understand command execution attack. I found a tutorial which described a task to create a file. Simply using

cat /etc/passwd | tee -a /tmp/passwd

Should create copy of /etc/passwd. And it is (running cat /tmp/passwd from the same place, where I ran the previous command returns exactly what I was expecting). But there is no /tmp/passwd if I try to run this command from the server's terminal (not from the site).

I did no setup for apache and php.

Where should I search for the missing /tmp/passwd?

As @terdon asks:

mount | grep tmp

will return:

devtmpfs on /dev type devtmpfs (rw,nosuid,size=1966708k,nr_inodes=491677,mode=755)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
tmpfs on /sys/fs/cgroup type tmpfs (rw,nosuid,nodev,noexec,mode=755)
tmpfs on /run type tmpfs (rw,nosuid,nodev,mode=755)
/dev/sda7 on /tmp type xfs (rw,relatime,attr2,inode64,noquota)
/dev/sda7 on /var/tmp type xfs (rw,relatime,attr2,inode64,noquota)
5
  • 4
    It's possible that the apache instance is chroot'd. In which case, it's going to be difficult for us to figure out what to tell you. If that's what's going on you just have to research the system.
    – Bratchley
    Nov 13 '14 at 19:31
  • 1
    What happens if you run touch /tmp/foo; ls -l /tmp/foo from the server?
    – terdon
    Nov 13 '14 at 20:02
  • @terdon it will show that there is no file with name /tmp/foo
    – kAldown
    Nov 13 '14 at 20:29
  • @terdon very appreciate to you for editing!
    – kAldown
    Nov 13 '14 at 20:30
  • Could you edit your question and include the output of mount | grep tmp please?
    – terdon
    Nov 13 '14 at 20:31
9

It is from a feature of systemd called PrivateTmp.

/var/tmp/systemd-private-*

is /var/tmp for the service with PrivateTmp option set in the .service file.

/tmp/systemd-private-*

is /tmp for the service.

If httpd writes something to /tmp, it will be in /tmp/systemd-private-*-httpd.service-*.

The differences between /tmp and /var/tmp are

The /var/tmp directory is made available for programs that require temporary files or directories that are preserved between system reboots. Therefore, data stored in /var/tmp is more persistent than data in /tmp.

Files and directories located in /var/tmp must not be deleted when the system is booted. Although data stored in /var/tmp is typically deleted in a site-specific manner, it is recommended that deletions occur at a less frequent interval than /tmp.

1
  • 5
    systemd isn't worth the pain it causes. Two hours of I my life I won't get back trying to find where the /tmp files were going.
    – null
    May 16 '17 at 15:56
5

In Fedora 20, the directory you're looking for is in one of the (possibly multiple) /var/tmp/systemd-private-${FOO} folders. I haven't been able to verify that on a RHEL 7 or CentOS 7 system yet, but I strongly suspect it will be in the same /var/tmp/systemd-private-${FOO} area.

2
  • Ok thank you, I'll check after a while. And where it's described? One thing I have found, it's in php_config, where it told to place some /tmp files right in system /tmp folder. So I think it's the same /tmp...
    – kAldown
    Nov 13 '14 at 19:42
  • $ sudo find /tmp -name 'SOMEFILE' => /tmp/systemd-private-7GE1Zo/tmp/SOMEFILE
    – kAldown
    Nov 13 '14 at 20:50
2

My approach is to find the PID of the running apache process

ps ax | fgrep http

Look for some plausible PID numbers in the left hand column. Then access the /tmp directory via the PID path through /proc which is kind of ugly but saves time figuring out who has found a new and exciting way to mess up the system this version.

ls -l /proc/12345/root/tmp

Those are the files that the httpd process is seeing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.