CODEWITHSUNDEEP
phplinuxsecurityapache
GhostInTheSecureShell
GhostInTheSecureShell

Reputation: 1010

Can PHP move around and edit root system files on a server?

this might seem like a stupid question but I've Googled to no avail.

I've always thought of PHP as a language for creating dynamic database driven sites, and I've never thought about using it to move system files on the actual server (as I have never had a need to). My question is:

  1. can a standard PHP 5.3.x.x installation move, copy or edit system files (I'm using a Linux sever as an example) around in /bin or maybe /etc?
  2. is this a good idea/practise?

It has never occurred to me that if a malicious hacker were to be able to inject some PHP into a site, that they would effectively be granted access to the entire Linux server (and all its system files). I have only ever thought of PHP as something that operates inside the /vhosts directory (perhaps naively).

Sorry if this sounds like a stupid question, but I can't really test my theory as if my boss was to see me writing/uploading/executing a script that moved stuff around in the Linux file system I would be dead.

Thanks for your help guys! :)

Upvotes: 4

Views: 1643

Answers (3)

DaveRandom
DaveRandom

Reputation: 88697

PHP can to your server whatever the permissions of the user account it runs as allow it to do. PHP as a language is not restricted in any way (at least, in terms of permissions), it is the user account that is restricted.

This is why people will usually create a user for Apache/nginx/insert web server here to run as, and only give it permissions to manipulate files and directories related to the web server. If you don't give this user access permissions to /bin or /etc, it's can't do anything that will affect them.

is this a good idea/practice?

Normally not. Leave system administration to your sysadmin and not the user requesting your PHP scripts.

Upvotes: 3

Shiplu Mokaddim
Shiplu Mokaddim

Reputation: 57660

Yes it can. Its a programming language, it can do anything.

It completely depends who is running it. If its root it can do anything. If its just a normal user bob. It can not do much outside the home /home/bob. Apache is also like bob. Apache usually runs under www-data, www, apache user names.

Upvotes: 1

James
James

Reputation: 3275

PHP can attempt to call many system commands to move or directly edit files on the hard disk. Whether it succeeds depends on the security settings.

Let's assume your running PHP thru apache and apache is set up to run all processes as the user www-data - a default setup for OS's like Debian. If you give the user www-data permission to edit /etc then yes, PHP can read and write to files in /etc

There is only one major drawback as you identified; security, security and security. You also better be sure that your PHP works properly as 1 wrongly written file could now take down the entire server.

I would also definitely not practice on your server behind your bosses back. Look into getting a cheap virtual machine, either hosted elsewhere or on your own machine curtsey of VirtualBox

Upvotes: 1

Related Questions