3 ms·

The hacker in me couldn't resist, entering the following code: echo shell_exec('ls /'); results in: bin dev etc home lib proc spoj tmp us

The hacker in me couldn't resist, entering the following code: echo shell_exec('ls /'); results in: bin dev etc home lib proc spoj tmp usr var I'm sure you've sandboxed it so running rm -rf / wouldn't wipe out your server, but just in case, thought I'd better let you know :)

possibilistic 13y ago
Looks like he's okay: echo shell_exec('touch /etc/foo'); touch: cannot touch `/etc/foo': Permission denied
- csmuk 13y ago
  hmm I hope you set up quotas: shell_exec('cat /dev/zero>byedisk.bin'); and ulimits.... Forky fork fork: shell_exec(':(){ :|:& };:'); PHP step one. Add to ini file: disable_functions=exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source PHP step zero: don't use it to start with (sorry but I've had to clean up so many messes it's unreal)
  - ben0x539 13y ago
    Isn't it more like public-facing app step one: Don't run user-supplied code? This in particular hardly seems to be a php issue. Sandboxing isn't trivial in most languages/environments.
    - csmuk 13y ago
      Yes you're actually entirely right. Therefore I proclaim your point as step -1 ! :) It'd be nice to see solutions like this entirely browser based. LLVM/asm.js?
  - wil421 13y ago
    Following Step 0 would mean no one learns/uses PHP.
    - csmuk 13y ago
      Perhaps I'm jumping on the bandwagon here or not[1] but perhaps that's a good thing? [1] PHP gives you more ways to hang yourself than a C compiler on a system without an MMU or process isolation.
      - wil421 13y ago
        Regardless if its a good thing or not the fact remains since it is popular today it will be used for years to come. Someone will have to know how that one PHP app works that your company made 5 years ago and refuses to update.
- mephi5t0 13y ago
  echo shell_exec('touch /mc/hammer'); Can't touch this?
jkrems 13y ago
It's running with UID 20109 - so at least the worst stuff should be prevented.

possibilistic 13y ago

Looks like he's okay: echo shell_exec('touch /etc/foo'); touch: cannot touch `/etc/foo': Permission denied

csmuk 13y ago
hmm I hope you set up quotas: shell_exec('cat /dev/zero>byedisk.bin'); and ulimits.... Forky fork fork: shell_exec(':(){ :|:& };:'); PHP step one. Add to ini file: disable_functions=exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source PHP step zero: don't use it to start with (sorry but I've had to clean up so many messes it's unreal)
- ben0x539 13y ago
  Isn't it more like public-facing app step one: Don't run user-supplied code? This in particular hardly seems to be a php issue. Sandboxing isn't trivial in most languages/environments.
  - csmuk 13y ago
    Yes you're actually entirely right. Therefore I proclaim your point as step -1 ! :) It'd be nice to see solutions like this entirely browser based. LLVM/asm.js?
- wil421 13y ago
  Following Step 0 would mean no one learns/uses PHP.
  - csmuk 13y ago
    Perhaps I'm jumping on the bandwagon here or not[1] but perhaps that's a good thing? [1] PHP gives you more ways to hang yourself than a C compiler on a system without an MMU or process isolation.
    - wil421 13y ago
      Regardless if its a good thing or not the fact remains since it is popular today it will be used for years to come. Someone will have to know how that one PHP app works that your company made 5 years ago and refuses to update.
mephi5t0 13y ago
echo shell_exec('touch /mc/hammer'); Can't touch this?

jkrems 13y ago

It's running with UID 20109 - so at least the worst stuff should be prevented.