2

I discovered this little PHP script that allows you to enter GET requests manually from the browser address bar and execute commands. I played around with it and discovered that I could do all kinds of things as www-data, including view the entire directory structure, copy files user accounts, painstakingly write scripts and PHP files, upload scripts, PHP files and executable programs, and upload and compile C source code.

I played with it on a spare machine that is not reachable from the Internet but it got me thinking about what could happen if this code was injected into a webpage (similar has been done with open source software I've used in the past) and wondering about steps that can be taken to lock down a server to prevent it.

So, is there any way to prevent www-data from executing commands that would allow these actions on a server, in case it is ever accessed in this manner?

Improve this question
6
  • Evidently, it's a really common back door. There must be ways to shut this kind of thing down; I just can't find them.
    – David Peterson Harvey
    Mar 17, 2014 at 4:14
  • it's hard to answer such question, what is this little php script that seems to be able to do things that shoudn't be possible?
    – Gintro
    Mar 20, 2014 at 11:25
  • Uploading files with GET?? a lot depends on your server settings (apache, nginx, lighttpd...), if you don't wan't browser access then shut down the related ports i.e. 80, 446 ...
    – Gintro
    Mar 20, 2014 at 11:32
  • Shutting down port 80 on a web server?
    – David Peterson Harvey
    Mar 26, 2014 at 21:47
  • Gintro, it uses the exec() function in PHP to execute commands. I've seen it in a couple of hacker videos now and it seems to be part of their standard toolkit. I've been playing with it on an Ubuntu server that's not accessible from the web to see what the dangers are in this script.
    – David Peterson Harvey
    Mar 26, 2014 at 21:49

1 Answer 1

Reset to default
0

If you do not need something, better turn it off, indeed.

There are two things that you can generally do:

1) If you do not need PHP, then turn it OFF. Under Ubuntu you can see the list of modules that are turned on under /etc/apache2/mods-enabled/

Try:

ls /etc/apache2/mods-enabled/

If you see entries such as php5.conf and php5.load, delete them. Similarly, you can find cgi*.* modules, and if installed others like ruby and perl (not installed by default). As mentioned by someone else, the suexec is also a potential problem because with "su" capability you can see the whole world.

2) If you do use PHP, then you can try to run mod-security. That will prevent a lot of things, assuming you turn on most of the checks they have there. However, it will also prevent a lot of legal things (i.e. if you have bash code on a page, that page may not get served at all!)

Of course, the main idea is to be able to install systems such as Drupal or Wordpress. Such use PHP and thus you are forced to use it. Now note that a system such as Drupal has a full security team working on issues that present potential danger to the server or the client using Drupal. So it is generally secure.

Improve this answer
5
  • Installing Drupal or Wordpress doesn't help with custom-designed code. :-) Of course, using prepared statements and mysql_real_escape_string are tools to help stop injection attacks. My sites use CMS systems in part but there are areas of the sites that use custom code. I'm always interested in what I can do to make them more secure. I'm new to having root access and managing my own server, though. It's definitely a learning experience. Thanks for telling me about mod-security. I'll give it a look.
    – David Peterson Harvey
    Mar 31, 2014 at 6:48
  • Another thing about suexec. I had a need to extend Drupal and do a few things as a user other than www-data (things that www-data is not allowed to do). Instead of allowing PHP to use suexec, I created some tools in C/C++ that would do just and only what I needed and I would run those. A binary can become any other user if you allow it in your operating system (with the s flag on the binary and properly owner/group information.) This is a much secure way because allowing suexec on PHP, any script could do anything...
    – Alexis Wilke
    Mar 31, 2014 at 7:26
  • So, @Alexis Wilke, how do you prevent suexec in PHP? Is there a place in the configuration to disallow it?
    – David Peterson Harvey
    Apr 6, 2014 at 1:21
  • suEXEC is an Apache2 module. If you did not enable it, then you're good. httpd.apache.org/docs/2.2/suexec.html -- to know, under Ubuntu, it would appear a soft-link (cyan if you have the default terminal colors in X11) if you do ls /etc/apache2/mods-enabled/.)
    – Alexis Wilke
    Apr 6, 2014 at 5:05
  • Oh, I get it. It's "su" as in "super user" exec. No, it's not enabled. Thanks for the advice. I have a lot to learn about Ubuntu and other Linux systems.
    – David Peterson Harvey
    Apr 8, 2014 at 7:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .