I have uploaded a simple PHP shell onto a server, but I get one of the following error messages when I am trying to execute a code:

Warning: shell_exec() Unable to execute 'ls' in .... on line 2

Warning: shell_exec() Unable to fork [ls] in ... on line

I think that there are some folder privileges that does not allow me to execute my code. How can I evade it?

Since that "open_basedir restriction in effect", is there a way to execute my shell?

  • 1
    Sounds like PHP is running under SElinux / AppArmor, which is preventing non-whitelisted forks from the Apache or PHP process. – Polynomial Dec 31 '16 at 11:28
  • Is there a way to evade it? – Manuel Dec 31 '16 at 11:38
  • Unlikely, without access to the configuration information on the server. – Polynomial Dec 31 '16 at 14:01
  • @Polynomial, you could post that as an answer instead of a comment. – Sjoerd Dec 31 '16 at 14:03
  • @Polynomial but, for example if I upload successful phpinfo() , I can get the information. Is it? – Manuel Dec 31 '16 at 14:05

The PHP function shell_exec calls the fork system call to create a new process for ls. It seems that the call to fork is blocked by some security policy.

You can still execute any PHP code that doesn't use blocked system calls. So even though you can not run ls, you can still obtain a file listing by running something like this:

  • Thank you! For example, if I wanna see files and directories in a specified path, eg: C:\inetpub\sitesdata\ I need to use scandir, so it will be: ' <?php $dir = 'C:\inetpub\sitesdata\'; print_r(scandir($dir)); ?>' – Manuel Dec 31 '16 at 15:06
  • Just tried, and not works because "open_basedir restriction in effect" – Manuel Dec 31 '16 at 15:21
  • @Sjoed , supposing that I've a file in: C:\testfolder\test\user\test.php , how can I read this file without call fork? – Manuel Jan 3 '17 at 18:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.