Recently a site of mine was hacked. For sure the attacker can execute PHP and start an interactive shell, etc.

I understand a hacker can delete files, or delete DB, the site folder, write in the cron of www-data to do some tasks.

What I don't understand is how with a limited user (www-data) can scale privileges in order to install a rootkit or something which would in theory involve more permissions or sudo.

How can a hacker can take a entire VPS server with the www-data user?

Thanks for your explanations.


That depends on how you've set it up.

As a normal user that can execute or even just read scripts, I can hunt through them to find any plaintext usernames or passwords for things like SQL connection strings or remote copy (like SCP) commands for herding files around.

There are plenty of vulnerabilities in many old PHP versions that make it possible to "break out" of a user shell into something more powerful. Make sure you're running updated versions of your software and that everything still gets security updates.

Since you mention only rootkits, I'm assuming there was some kind of user escalation. However, there are plenty of things a normal user with a shell can do that you definitely don't want to happen. While your entire node may not be compromised in that case, your scripts may be - and you can do quite a lot with that. Make sure your script permissions are tight.

In general, this question is way too broad to actually answer. You're asking a question that is answered by the breadth of an entire professional field.

| improve this answer | |
  • Thanks, I somewhat know what a user can do with it's theoretical limitations, but I wasn't sure how a user can scale those privileges. In summary, with www-data only using apache in PHP site, it seems that a good way to protect the server is to have updated the software. – Beto Aveiga Apr 27 '18 at 17:18
  • That's a good step for certain, but I also have no idea what your file permissions look like, or if you allow this user to have a shell, or if you're using potentially more vulnerable software other than just PHP. It's really hard to talk about this kind of thing free-form without sitting at the terminal and looking at how everything (and I mean everything) is. – Spooler Apr 27 '18 at 17:21
  • @Spooler what do you mean by breaking out of user shell to something more powerful with PHP? I assume nobody runs PHP as suid binary. – AlexD Apr 27 '18 at 17:34
  • 2
    "I assume..." In a security context, this almost always ends poorly. – EBGreen Apr 27 '18 at 17:42
  • Avoiding assumptions is a good point. If we're talking about security we should at least attempt to stay real even when mostly hypothetical. I certainly didn't make a great effort of that in my answer. @AlexD I've only seen that once, and it was genuinely shocking. Aside from that, I'm not personally aware of any escalation paths that don't involve zebras. – Spooler Apr 27 '18 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.