Need some help in "exec"-attack

From: Date: Mon, 13 Jan 2003 11:53:46 +0000
Subject: Need some help in "exec"-attack
Groups: php.general 
Request: Send a blank email to php-general+get-131421@lists.php.net to get a copy of this message
Hi all, this is my situation: I want to execute some comands using 'shell_exec': $command=shell_exec("ls -la /usr/dest_dir;cp -R /usr/source_dir/1.php /usr/dest_dir;cd /usr/dest_dir;ls -la"); echo "<pre>$command</pre>"; Actually, these commands: 1) ls -la /usr/dest_dir 2) cp -R /usr/source_dir/1.php /usr/dest_dir 3) cd /usr/dest_dir 4) ls -la This is what I get: total 8 drwxr-xr-x 2 mysql mysql 4096 Jan 13 13:29 . drwxr-xr-x 18 mysql mysql 4096 Jan 13 12:25 .. total 8 drwxr-xr-x 2 mysql mysql 4096 Jan 13 13:29 . drwxr-xr-x 18 mysql mysql 4096 Jan 13 12:25 .. the first 3 lines, before the 'cp' command the last 3 lines, after the 'cp' command. As you can see, no changes. I've looked in the logs of the apache webserver and i've found this line: cp: cannot create regular file `/usr/dest_dir/1.php': Permission denied Note: source_dir and dest_dir are both owned by mysql Another thing : cp: cannot create regular file `/usr/dest_dir/1.php': Permission denied The path begin with a back tick . Is that normal?

« previous php.general (#131421) next »