2

Is it possible that a user can hack a server running Apache httpd from the website it hosts? Let's say I have a PHP web application running under Apache with explicit user www-data in the virtual host configuration. If the user hacks the website, he would only have access to modify the PHP code, since he only has the privileges of the www-data user.

Could the attacker leverage this limited access to reach user or system files, effectively taking control of the operating system?

Improve this question
13
  • 2
    What you describe happens often. It is possible to use weaknesses in the PHP code to gain access to the OS. Not how you describe it, though.
    – schroeder ♦
    Commented Jan 25, 2020 at 20:38
  • @VipulNair Can you be more specific?
    – user3502626
    Commented Jan 25, 2020 at 20:39
  • @schroeder As the php code is executed by Apache so, the user www-data does not restrict file access? Because if I don't chown www-data folder, PHP returns an access denied error.
    – user3502626
    Commented Jan 25, 2020 at 20:44
  • 1
    Think of it in stages. If you have the appropriate levels of controls, the attacker needs to find a different way through each layer. Each layer might require very different ways through. If the site, and the server, is poorly written enough to not have any layers, it is possible to simply hack the site and gain root access. For instance, if the site was running as root.
    – schroeder ♦
    Commented Jan 25, 2020 at 20:48
  • 1
    My answer below tells you the other side of the coin. Just because you restrict www-data to just the PHP project does not also mean that the data it can access won't be able to permit it to elevate.
    – schroeder ♦
    Commented Jan 25, 2020 at 21:12

1 Answer 1

Reset to default
5

Let's suppose that the site allows uploads without protection and I am able to upload a PHP shell. I access the shell, which gives me terminal access. At this point, I am running commands on the operating system as www-data or whatever user the site is configured to run as.

Now I can hunt around for configuration files that might have root passwords in it or vulnerabilities in the OS that would let me gain root access. Now I'm using the PHP, served by Apache, to run commands as root.

Once I get root, I can obviously also gain access to any user's files on the system. The system is mine (and anyone else who accesses the shell).

This is just one of many possibilities.

Improve this answer
2
  • That's a good warning. You said: Now I can hunt around for configuration files that might have root passwords in it. Those configuration files are just configuration files in the PHP project? Because if a file does not have www-data read permission and does not give access to other the PHP script won't be able to open the configuration files. Or can it?
    – user3502626
    Commented Jan 25, 2020 at 20:54
  • Whatever the user has access to. You are asking very specific questions about how you might have configured your system, and I won't comment on that without being able to see your full configuration (and doing that it off-topic here). The prinicples are established, though.
    – schroeder ♦
    Commented Jan 25, 2020 at 20:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .