1

I am trying to run a script that does "apt-get install" on a webserver through PHP but cant seem to get it to work. If I were to run the script locally on the terminal using:

sudo /var/www/html/dl.sh

It works. But after using this code...

forcedl.php:

 <?php
      if ($_GET['run']){
        $output = shell_exec("/var/www/html/dl.sh");
        echo "<pre>$output\n</pre>";
      }
    ?>

<a href=?run=true>Click Here</a>

dl.sh:

#!/bin/bash
sudo apt-get install slowhttptest

and after clicking on CLICK HERE (If commands in dl.sh were changed to ifconfig, it works) on another machine, nothing happens on the server that the script is supposed to run on.

If I remember correctly, I have installed PHP and Apache2. I don't know if anything else is required to make this work.

Requested command:

ls -lZ /var/www/html/dl.sh

Output is:

rwxr-xr-x 1 root root ? 188 Jan 2 21:58 /var/www/html/dl.sh

Edit #2:

I solved the issue by adding WWW-DATA in sudoers and editing my PHP.

forcedl.php:

 <?php
      if ($_GET['run']){
        $output = shell_exec("sudo /var/www/html/dl.sh");
        echo "<pre>$output\n</pre>";
      }
    ?>

<a href=?run=true>Click Here</a>
  • 2
    What's about dl.sh output when it content is whoami? – Zumo de Vidrio Jan 2 at 13:32
  • Please, edit your question and add the output of the command sudo ls -lZ /var/www/html/dl.sh. – andcoz Jan 2 at 13:48
  • @ZumodeVidrio, for some reason, there is no output. – Syuuバカ Jan 2 at 14:03
  • 4
    god thanks your php isn't running as root; it's sad that some people have been conditioned to prepend sudo to any command that "doesn't work" to the point where they have forgotten what that nasty piece of work is actually doing – mosvy Jan 2 at 14:09
  • 1
    Your webserver is probably running as the www-data user, or a similar non-root user. Unless you've set up your /etc/sudoers file (or a file in /etc/sudoers.d/) to allow that user to run that script with no password, and no tty, you'll be stopped by either or both of those issues. – Tim Kennedy Jan 2 at 14:59
3

PHP is (thankfully!) not running as the root user, so it does not have privileges to run apt install. The suid bit is ignored on shell scripts, so setting that bit on your shell script is not a solution, either.

If you really really want to give PHP the privileges to run apt-get as the root user (and please, think really hard about this), you can add an entry to sudoers to allow it to do so, but your command will have to be sudo apt-get [...].

Running a script through a web based front-end via a sudo grant is ill-advised, because if somebody somehow figures out a way to edit that file, now they can do whatever they want to do on your system as the superuser by having PHP do it for them.

  • 1
    probably also need to add !RequireTTY to that sudo config. And yeah, allowing a webserver to run anything via sudo is just asking for trouble. – Tim Kennedy Jan 2 at 15:02
  • Hm.. So to allow it, I will just have to add an entry to 'sudoers' and ensure my command has 'sudo' in it? Since this is just a test to simulate that an attacker has put in a script into the webserver, my professor has given an OK for any method used. He just told me to get it to work haha. – Syuuバカ Jan 3 at 3:38
  • @TimKennedy, Able to elaborate more on that? – Syuuバカ Jan 3 at 3:39
  • @Syuuバカ sudo usually requires a TTY because it's default behavior is to attempt interactive authentication. When you do something like allow a webserver to run a script non-interactively, you would need to configure sudo appropriately, by adding NOPASSWD and !RequireTTY to the appropriate place(s) in the sudoers file. It's hard to be more specific because there are a myriad of ways to add those options. – Tim Kennedy Jan 3 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.