Sunday, 15 January 2012

linux - Run bash command via PHP, change dir then execute binary -


So what I'm trying to do here is to start a binary under a PHP script I am trying to Apache has pseudo access, this work works fine when it runs through a logged-in screen as a "test".

  Pastor ('Bash-C' pseudo-o test CD / home / test / cs /; / hlls_r un '');  

I can also add

  past ('Bash-C' pseudo-o test. / Home / test / cs / hlds_run "') ;  

How the binary is written, will not work because of this (unless you test it on the terminal, it will not get the resource)

If everyone has access to / home / test / cs :

  Pastra ('CD / Home / Test / CS & SUUDO-U Test ./hlds_run');  

If only user test has access to the directory:

  passhtru ('sudo -u test sh -c' cd / home / test / cs & amp; / hlds_run ''); To arrive at the second allocation, you should already be familiar with the  system  vs  execve  ( passthru  and  sudo  Respectively). 

  1. This is the shell string we set to run as a specific user:

    CD / Home / Test / CS & amp; ./hlds_run

  2. We can make sure that it always runs with sudo as a specific user, but sudo Uses Exotic Semantics We need to convert our Shell string to a execve array, and because this command is a shell functionality such as cd Is dependent on and does not include dynamic values ​​in B, the best way to do this is simply to interpret verbatim To open a shell is:

    { sh , -c , cd / home / test / cs & amp;

  3. Now we can implement sudo to run as our specific user:

    {< Code> pseudo , -u , test , sh , -c , cd / Home / test / cs & amp; Amp; ./hlds_run }

  4. passthru runs in the form of a shell, so now let us see the execve shell The above array in the string, quoting to ensure the shell, will be parsed in the exact logic list above with extreme caution. Fortunately this is a relatively simple matter:

    pseudo-o test sh -c "cd / home / test / cs and ./ hlds_run"

    < / Li>
  5. Now let us give it to passthru :

    passthru ('sudo -u test sh -c) for CD / Home / Test Can / cs & amp; ./hlds_run "');


No comments:

Post a Comment