Web Hosting Talk : Web Hosting Main Forums : Programming Discussion : IMPORTANT For SERVER OWNERS.

[host911]

Hello,

I don't know if any of you saw this script before, it's called PHPSHELL, even if you didn't allow telnet or SSH on you server they can view your root directories. I think all server owners should block or delete this script from their servers.

the URL is: http://www.gimpster.com/php/phpshell/index.php

Take care,

[Nadav]

Eeek. Scary.

[MultiVol]

Scary

[Rich2k]

Surely the functions required to run such a script are blocked by safe_mode ?

[MultiVol]

Ahh the safe mode, hmm...

[DavidU]

What a stupid program...

heh.

It runs as the webuser so I think the potential damage is pretty low but you never know...could hit up other webusers's files and molest them.

-davidu

[dreamrae.com]

ahhh!!!

[DD-SNC]

This script is very very gay.

[microsol]

This script is very old. You should be save if you run php in safe mode.

[roby2k]

just to let u know users are very limited on what they can see and use. they have no way of altering things they maybe able to view somethings but not all if i remember right they can not see most things it will just redirect to the folder the file is in everytime they try to do something.

[DavidU]

Originally posted by DD-SNC
This script is very very gay.

How can a php script be gay?

Has AI technology progressed that much?

-davidu

[LinuXpert]

Originally posted by roby2k
just to let u know users are very limited on what they can see and use. they have no way of altering things they maybe able to view somethings but not all if i remember right they can not see most things it will just redirect to the folder the file is in everytime they try to do something.

yes, that's right. They can't even delete their own files. This script is not new, actually there are many scripts like this written in Perl.

[apokalyptik]

Truth: I didnt even bother looking at the script

Truth: I probably know what it does

Description: runs commands typed into a web browser

Truth: these commands are then run as the httpd daemon username, on unix this is probably 'nobody'. In this case you can _ONLY_ execute command with o+x, and _ONLY_ read files with o+r, and _ONLY_ modify files with o+w (duh?)

Truth: this script idea is about 10 years old

Truth: if you're really paranoid about this script then do one of a couple things: 1) look into user mode linux 2) chroot 3) stop web hosting, because worrying about this is like worrying about whether or not your win2k box is secure - its just dumb.

sorry, thats my opinion

[bonahost]

Originally posted by NetworksData

yes, that's right. They can't even delete their own files. This script is not new, actually there are many scripts like this written in Perl.

As far php run as nobody in your server, I can make your server down using this script.

[DavidU]

Originally posted by bonahost


As far php run as nobody in your server, I can make your server down using this script.

But the real question is: "Can you write a complete sentence?"

And by "down" do you mean cracked, DoS'd, or what?

A DoS does not show any sort of skill whatsoever and is pretty much reserved for fools and morons.

-davidu