1

I have simple PHP code like this:

<?php
print_r(shell_exec($_GET['c']));

now I want to run commands with root privileges through URL. I have added www-data as sudoers and I try this curl -vv "http://localhost/index.php?c=echo mypass|sudo -S -s 'whoami'" but I can't see anything in output

This code is just for fun, also I don't want to write my commands in bash script and run them with PHP, I want to know whats wrong with this code

Ebrahim Poursadeqi
  • 1,776
  • 2
  • 17
  • 27
  • 2
    What you've got is an exceedingly bad idea. – user3942918 Jul 31 '17 at 07:53
  • I know,it's just for fun, I don't want to use it anywhere – Ebrahim Poursadeqi Jul 31 '17 at 07:55
  • that's a really bad idea to run a command with root privileges from an URL. You really should avoid that. maybe this thread will help you https://stackoverflow.com/questions/1598231/how-to-run-php-exec-as-root – sheplu Jul 31 '17 at 07:56
  • 2
    Guys he stated it's "just for fun". Let him do what he wants, as long as he knows why it's a bad idea :) *Have you also tried executing your script with sudo*? – Jimbo Jul 31 '17 at 07:59
  • suppose I can't run this script with sudo command, all I can do it's just run this file regulary and I can add `www-data` to sudoers user groups too @Jimbo – Ebrahim Poursadeqi Jul 31 '17 at 18:29
  • @EbrahimPoursadeqi: So when someone makes the effort to answer a question of yours, you delete it?! – juergen d Aug 14 '17 at 10:16

0 Answers0