8

php-fpm, nginx exec when in use .phpfiles() shell_exec() system() works fine from the command line.

Example when works well:

#php myphp.php

myphp.php contains:

<?php
exec('ping -c 3 google.com', $output);
print_r($output);
?>

But if I put on my browser http://localhost/myphp.php, it does not work anymore.

Any ideas? I edit

I made a file with the following contents:

#cat info.php

<?php
if(function_exists('exec')) {
    echo "exec is enabled";
}
    phpinfo();
?>

In my browser, print

exec is enabled, y php info..

I made a file with the following contents:

#cat info.php

<?php 
// Check for safe mode
if( ini_get('safe_mode') ){
    // Do it the safe mode way
echo "Do it the safe mode way";
}else{
    // Do it the regular way
echo "Do it the regular way";
}

?>

In my browser, print

Do it the regular way

Did not I like to know if I'm in a jail?

In my php ini

#cat /etc/php-5.5.ini

safe_mode not shown, or ON or OFF. simply does not exist

laur
  • 500
  • 1
  • 9
  • 23

4 Answers4

2

I think exec and those kind of functions are disabled in your php.ini . You can check it by

if(function_exists('exec')) {
    echo "exec is enabled";
} else {
    echo "exec is disabled";
}

Open your php.ini and navigate to section disable_functions

If exec is listed under there , remove it.

Then restart php-fpm.

Also If Safe Mode is enabled this function will not be available. You need to disable it.

Edit

use full path for ping. You can find it by issuing this command in shell which ping

Edit

<?php
exec('/sbin/ping -c3 google.com', $output);
print_r($output);
?>
Harikrishnan
  • 9,688
  • 11
  • 84
  • 127
0

Php-fpm is chrooted by default on OpenBSD. That's probably the cause you see it working on cli and not on web.

You've two solutions. Disable chroot (comment the line chroot = /var/www on /etc/php-fpm.conf) or fix the issues you may encounter.

A static compiled version of ping resides under /bin/ping (from inside the chroot). You'll need to copy /etc/hosts and /etc/resolv.conf inside the chroot in order to resolv hosts names (as you're trying to do pinging google). All other system commands you plan to call must be copied inside the chroot also (along with their shared libraries or compiled statically).

Use ldd(1) to find out which libraries you'll need. Depending on what you're trying to achieve it could be a tedious work.

Exec, system and shell_exec are probably disabled, as other users pointed out.

0

<?php
//echo "Вот-вот... ещё 1 мин";
//echo "Wait... 1 min";
echo exec('/bin/bash --login -c "cd /var/www/194.7.2.2/public && /usr/local/rvm/rubies/ruby-2.5.3/bin/ruby work1.rb "'.$_GET['some_value']);

It`s worked 4me!

  • Just a tip: generally, answers are much more helpful if they include an explanation of what the code is intended to do, and why that solves the problem without introducing others. – shkaper Feb 05 '19 at 18:05
0

After spending hours debugging. this solved mines.

  1. Edit /etc/php/7.4/fpm/pool.d/www.conf

  2. Uncomment & adjust this lines:

    env[PATH] = /usr/local/bin:/usr/bin:/bin:/add_your_executable_files_path_here

    env[TMP] = /tmp

    env[TMPDIR] = /tmp

    env[TEMP] = /tmp

  3. Restart php-fpm service php7.4-fpm restart

Environment

nginx, php-fpm7.4, debian 9.13

Brain90
  • 1,551
  • 18
  • 21