0

This question already has an answer here:

I find php files with SGID bit and read-only & execute. The group is root. Is this a problem?

Because a user will need to run the php interpreter with their our account, could it led to privilege escalation?

Like, the user www-data runing php as www-data and call the file with SGID bit, could he became root?

php path/to/file.php

marked as duplicate by Christopher, Jeff Schaller, Community Jan 22 at 19:32

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Linux? The kernel has been configured by default to ignore both setuid and setgid of any interpreted executable script. – Christopher Jan 22 at 13:05
1

Yes; sgid:root will run the file as root if run directly on an OS with sgid-on-!# enabled, and if the php file can be tricked into writing to an arbitrary file due to lack of input sanitation, etc.

That's a big IF but defence in depth is advised because bugs are plentiful..

Test suid;

./test.php && whoami
root
www-data

Where test.php contains

#!/usr/bin/php
echo exec('whoami');

Allow setuid on shell scripts

Notes how modern implementations deal with interesting ways to take advantage of sgid

https://www.in-ulm.de/~mascheck/various/shebang/#setuid

Notes the #! simlink attack was an issue from 1983 to 1993 before which shebang wasn't supported and after which it was more securely implemented.

  • Are sure? GUID set for script..... – Romeo Ninov Jan 22 at 13:02
  • 1
    @user1133275, are you referring to a case where the OS applies setuid/setgid even on interpreted scripts? You might want to make that explicit, since AFAIK that's not very common. Even so, surely they wouldn't run the script as root (the user), if it only has the set_gid_ bit set? And if that happens, then surely the script runs with root's GID regardless of input sanitization problems? – ilkkachu Jan 22 at 13:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.