Some one has modified a PHP file, which had permissions set to 777, on my VPS server.

How can someone do that without administrative access to the server?

What information I can give you?

I know nothing was modified through FTP or through the Kloxo control panel. So PHP would be the only way?

How can the 777 permission allow someone to modify a PHP file on a web server?

  • What's the question here? – Polynomial Feb 11 '13 at 18:57
  • 9
    Someone can not, in fact, access your server without access to your server. – Cory J Feb 11 '13 at 19:28
  • Cory, possibly not helpful but you get the ups for the cut of your jib :-P – grauwulf Feb 11 '13 at 19:33
  • "PHP injection" is not a real vulnerability. Someone modifying files on your system is the result of a vulnerability. – rook Feb 11 '13 at 20:19
  • 1
    @Rook, I'm sorry... Maybe I misread that. "Runtime code injection isn't a 'real' vulnerability?" You may want to take that one over to academic.so, I think you have a new thesis statement there. – grauwulf Feb 11 '13 at 21:04

The "777" is octal for local permissions in the Unix sense; this means that the file can be written to by any process on this machine (all users have read and write access to the file). This is local: this is about access rights for process which run on the machine. Someone from the outer world does not have, by default, the possibility to make arbitrary process run on your system under any user ID.

However, you say "PHP", which means that you operate a Web site with PHP enabled. Thus, you may have a security hole in your site which allows an attacker, with the help of maliciously crafted requests, to trigger a file write operation where the attacker can choose the target file. The operation will be performed by the Web server process, with the user ID under which that process runs (e.g. www-data -- that's what it does on my server). Since the target file is "world-writable", the write succeeds. The "777" access rights are not the security hole here, but they help the attacker by giving him ways to exploit the hole into further mischief.

(This is all guesswork. You are not exactly giving me a lot of information here.)

  • the password is too hard to hack? is something like this rHDqiZyEZhY – Costel Cocerhan Feb 12 '13 at 15:36

The reason someone was able to modify your file is that the 777 permission set gives full read, write, and execute to all users who interact with that file. In your case it is most likely that someone used your php script, or a different one, to edit your files on the server. Sadly; PHP has many functions that allow this type of manipulation (i.e. everything in the exec family). To avoid this type of problem in the future you will need to carefully review your file permissions as well as your PHP scripts.

Without those scripts, however, I'm afraid that SO will not be able to provide much in the way of directed guidance.

Not the answer you're looking for? Browse other questions tagged or ask your own question.