PHP commands

[Silverman]

I am trying to put a command line through some php I have but not having any luck.

 

It seems quite simple but I cannot get it working. I want to use the shutdown command within php using the system or exec functions. If I use the following code I get an access denied, and if i replace the ip address with a host name I get a host unreachable error.

Heres the line:

<?php

system("shutdown -r -m xxx.xxx.xxx.xxx");

?>

 

Thanks.

[CESIL]

I would have to guess that this is a permissions problem.

 

If the page containing this code is running on a server then it will probably be using the anonymous user account which would not normally have permission to do this sort of thing.

 

What web server is this running on, IIS?

[Silverman]

I just have it running locally on wampserver so that i can work with php.

[el8linuxel8]

probably easier to use backticks whilst debugging.

 

$output = `shutdown etc`;

print $output;

 

should give you the response.

[Silverman]

'Access is denied.' still

 

I assume i need to embed some credentials somewhere or something along these lines.

[el8linuxel8]

Yea at least that proves that.

 

i know with nix you could use posix_setuid to create a suid php file but not sure with winblows.

 

depends what uid apache is running as, its easier to do it with IIS.

 

what wamp are you using? a fully packaged one or did you build it yourself?

[Silverman]

Currently using wamp 2.0, a ready packaged one.

[el8linuxel8]

I'd try adding permissions for 'everyone' to cmd.exe and c:\windows\system32\shutdown.exe too then, see how that goes then think about refining those permissions to not include 'everyone'

[Silverman]

No luck unfortunatly.

[el8linuxel8]

Yeah, you'll have to use runas i think

 

something like

 

`runas /noprofile /user:DOMAIN\administrator shutdown -r -m xxx.xxx.xxx.xxx`

 

the unfortunate thing is runas takes the password via . so you would have to use sanur.exe (google it if you dont know it).

 

the other option, and the slightly more fun one, is to use proc_open() within php.

 

something like:

 

$descriptorspec = array(
  0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
  1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
);

$cwd = '/tmp';
$env = array('some_option' => 'aeiou');

$process = proc_open('runas /noprofile /user:DOMAIN\administrator shutdown -r -m xxx.xxx.xxx.xxx ', $descriptorspec, $pipes, $cwd, $env);

if (is_resource($process)) {
   // $pipes now looks like this:
   // 0 => writeable handle connected to child stdin
   // 1 => readable handle connected to child stdout
   // Any error output will be appended to /tmp/error-output.txt

   fwrite($pipes[0], 'YOURADMINPASSWORD');
   fclose($pipes[0]);

   echo stream_get_contents($pipes[1]);
   fclose($pipes[1]);

   // It is important that you close any pipes before calling
   // proc_close in order to avoid a deadlock
   $return_value = proc_close($process);

   echo "command returned $return_value\n";
}
?>

 

alot more fun :hat:

[srochford]

Can PHP do WMI calls? If so, it might be easier to do the shutdown like that - you can put appropriate credentials in the call to connect to the WMI namespace.

 

the other thing to think about if this doesn't work is that it may not be that you don't have permission to access the file "shutdown.exe" but you don't have permission to actually shutdown a remote system. What security context does apache run under? If it's a local, low privilege account then even though it can read shutdown.exe it won't be able to run it. Similarly, if it's localsystem then you have no rights to talk to the network so shutdown would fail.