3

What harm can virus sites that contain malicious PHP code cause? What is an example of a piece of PHP code that could potentially harm your computer or steal information?

I know that most if not all client-side code cannot cause any harm, but how about the server-side code, what harm could it cause?

I was always curious as to how a website could harm your computer ...

  • 1
    Are you envisioning an external web server that hosts malicious PHP code harming your computer when you open the web page in a browser? – CBHacking Jun 7 '18 at 1:03
  • 2
    Cause harm where? At the server side, or the client side? – ThoriumBR Jun 7 '18 at 2:25
  • In the most severe case, an attacker could deploy Wordpress to your server. – gowenfawr Jun 7 '18 at 12:57
  • PHP has nothing to do with client side. Asking what harm PHP can cause your client is the same as asking what harm visiting any website can cause your client. – AndrolGenhald Jun 7 '18 at 13:11
5

It all comes down to the credentials that that PHP code is running with on the server.

If the apache2 process running that PHP code is running as www-root, the damage that this script can do goes to the extent of what www-root can access, which would typically mean all of the /var/www/ folder.

To fully understand this question, one needs to understand how linux works, if the web server is running under linux, to fully understand the extent of the possible damage.

If it's running under Windows, it would be the same thing, only the damage would be to the extent of what the owner of the process is able to use the machine's resources for.

Things that typically PHP viruses do are:

  1. Use your server to send spam
  2. Use your server to brute force other servers
  3. Use your server's resources to join their own rig and mine crypto-currencies

Those are just a few. They can pretty much use your server to run any software.

2

Server Side

As Wadih M. said in his answer, it largely depends on what user the php cgi script is running as. That being said, even with www-root user level access the attacker could:

  • Spawn other processes on your box (email zombie, or part of a DDoS attack)
  • Extract your entire database which could contain your user account credentials
  • Run port scans / exploits against localhost (which may have lesser firewall restrictions)
  • Modify other parts of your website to include malware which will infect your user's computers
  • Crash your entire server w/ a ForkBomb

Client Side

If I browse to a website that is infected the following could happen:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.