Need some help in "exec"-attack
| From: | Alex Ciurea | Date: | Mon, 13 Jan 2003 11:53:46 +0000 |
| Subject: | Need some help in "exec"-attack | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-131421@lists.php.net to get a copy of this message | ||
Hi all,
this is my situation:
I want to execute some comands using 'shell_exec':
$command=shell_exec("ls -la /usr/dest_dir;cp -R /usr/source_dir/1.php
/usr/dest_dir;cd /usr/dest_dir;ls -la");
echo "<pre>$command</pre>";
Actually, these commands:
1) ls -la /usr/dest_dir
2) cp -R /usr/source_dir/1.php /usr/dest_dir
3) cd /usr/dest_dir
4) ls -la
This is what I get:
total 8
drwxr-xr-x 2 mysql mysql 4096 Jan 13 13:29 .
drwxr-xr-x 18 mysql mysql 4096 Jan 13 12:25 ..
total 8
drwxr-xr-x 2 mysql mysql 4096 Jan 13 13:29 .
drwxr-xr-x 18 mysql mysql 4096 Jan 13 12:25 ..
the first 3 lines, before the 'cp' command
the last 3 lines, after the 'cp' command.
As you can see, no changes.
I've looked in the logs of the apache webserver and i've found this line:
cp: cannot create regular file `/usr/dest_dir/1.php': Permission denied
Note: source_dir and dest_dir are both owned by mysql
Another thing :
cp: cannot create regular file `/usr/dest_dir/1.php': Permission denied
The path begin with a back tick . Is that normal?