2

Is it possible that a user can hack a server running Apache httpd from the website it hosts? Let's say I have a PHP web application running under Apache with explicit user www-data in the virtual host configuration. If the user hacks the website, he would only have access to modify the PHP code, since he only has the privileges of the www-data user.

Could the attacker leverage this limited access to reach user or system files, effectively taking control of the operating system?

  • 2
    What you describe happens often. It is possible to use weaknesses in the PHP code to gain access to the OS. Not how you describe it, though. – schroeder Jan 25 at 20:38
  • @VipulNair Can you be more specific? – user3502626 Jan 25 at 20:39
  • @schroeder As the php code is executed by Apache so, the user www-data does not restrict file access? Because if I don't chown www-data folder, PHP returns an access denied error. – user3502626 Jan 25 at 20:44
  • 1
    Think of it in stages. If you have the appropriate levels of controls, the attacker needs to find a different way through each layer. Each layer might require very different ways through. If the site, and the server, is poorly written enough to not have any layers, it is possible to simply hack the site and gain root access. For instance, if the site was running as root. – schroeder Jan 25 at 20:48
  • 1
    My answer below tells you the other side of the coin. Just because you restrict www-data to just the PHP project does not also mean that the data it can access won't be able to permit it to elevate. – schroeder Jan 25 at 21:12
5

Let's suppose that the site allows uploads without protection and I am able to upload a PHP shell. I access the shell, which gives me terminal access. At this point, I am running commands on the operating system as www-data or whatever user the site is configured to run as.

Now I can hunt around for configuration files that might have root passwords in it or vulnerabilities in the OS that would let me gain root access. Now I'm using the PHP, served by Apache, to run commands as root.

Once I get root, I can obviously also gain access to any user's files on the system. The system is mine (and anyone else who accesses the shell).

This is just one of many possibilities.

  • That's a good warning. You said: Now I can hunt around for configuration files that might have root passwords in it. Those configuration files are just configuration files in the PHP project? Because if a file does not have www-data read permission and does not give access to other the PHP script won't be able to open the configuration files. Or can it? – user3502626 Jan 25 at 20:54
  • Whatever the user has access to. You are asking very specific questions about how you might have configured your system, and I won't comment on that without being able to see your full configuration (and doing that it off-topic here). The prinicples are established, though. – schroeder Jan 25 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.