Where apache's /tmp located?

Question

I was just advised to re-ask my question from https://security.stackexchange.com/questions/72795/command-execution-dvwa-creating-file-in-tmp here.

I use CentOS 7, and I'm trying to understand command execution attack. I found a tutorial which described a task to create a file. Simply using

cat /etc/passwd | tee -a /tmp/passwd

Should create copy of /etc/passwd. And it is (running cat /tmp/passwd from the same place, where I ran the previous command returns exactly what I was expecting). But there is no /tmp/passwd if I try to run this command from the server's terminal (not from the site).

I did no setup for apache and php.

Where should I search for the missing /tmp/passwd?

As @terdon asks:

mount | grep tmp

will return:

devtmpfs on /dev type devtmpfs (rw,nosuid,size=1966708k,nr_inodes=491677,mode=755)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
tmpfs on /sys/fs/cgroup type tmpfs (rw,nosuid,nodev,noexec,mode=755)
tmpfs on /run type tmpfs (rw,nosuid,nodev,mode=755)
/dev/sda7 on /tmp type xfs (rw,relatime,attr2,inode64,noquota)
/dev/sda7 on /var/tmp type xfs (rw,relatime,attr2,inode64,noquota)

Answer 1

It is from a feature of systemd called PrivateTmp.

/var/tmp/systemd-private-*

is /var/tmp for the service with PrivateTmp option set in the .service file.

/tmp/systemd-private-*

is /tmp for the service.

If httpd writes something to /tmp, it will be in /tmp/systemd-private-*-httpd.service-*.

The differences between /tmp and /var/tmp are

The /var/tmp directory is made available for programs that require temporary files or directories that are preserved between system reboots. Therefore, data stored in /var/tmp is more persistent than data in /tmp.

Files and directories located in /var/tmp must not be deleted when the system is booted. Although data stored in /var/tmp is typically deleted in a site-specific manner, it is recommended that deletions occur at a less frequent interval than /tmp.

Answer 2

In Fedora 20, the directory you're looking for is in one of the (possibly multiple) /var/tmp/systemd-private-${FOO} folders. I haven't been able to verify that on a RHEL 7 or CentOS 7 system yet, but I strongly suspect it will be in the same /var/tmp/systemd-private-${FOO} area.

Answer 3

My approach is to find the PID of the running apache process

ps ax | fgrep http

Look for some plausible PID numbers in the left hand column. Then access the /tmp directory via the PID path through /proc which is kind of ugly but saves time figuring out who has found a new and exciting way to mess up the system this version.

ls -l /proc/12345/root/tmp

Those are the files that the httpd process is seeing.