0

Recently a site of mine was hacked. For sure the attacker can execute PHP and start an interactive shell, etc.

I understand a hacker can delete files, or delete DB, the site folder, write in the cron of www-data to do some tasks.

What I don't understand is how with a limited user (www-data) can scale privileges in order to install a rootkit or something which would in theory involve more permissions or sudo.

How can a hacker can take a entire VPS server with the www-data user?

Thanks for your explanations.

1 Answer 1

2

That depends on how you've set it up.

As a normal user that can execute or even just read scripts, I can hunt through them to find any plaintext usernames or passwords for things like SQL connection strings or remote copy (like SCP) commands for herding files around.

There are plenty of vulnerabilities in many old PHP versions that make it possible to "break out" of a user shell into something more powerful. Make sure you're running updated versions of your software and that everything still gets security updates.

Since you mention only rootkits, I'm assuming there was some kind of user escalation. However, there are plenty of things a normal user with a shell can do that you definitely don't want to happen. While your entire node may not be compromised in that case, your scripts may be - and you can do quite a lot with that. Make sure your script permissions are tight.

In general, this question is way too broad to actually answer. You're asking a question that is answered by the breadth of an entire professional field.

5
  • Thanks, I somewhat know what a user can do with it's theoretical limitations, but I wasn't sure how a user can scale those privileges. In summary, with www-data only using apache in PHP site, it seems that a good way to protect the server is to have updated the software. Apr 27, 2018 at 17:18
  • That's a good step for certain, but I also have no idea what your file permissions look like, or if you allow this user to have a shell, or if you're using potentially more vulnerable software other than just PHP. It's really hard to talk about this kind of thing free-form without sitting at the terminal and looking at how everything (and I mean everything) is.
    – Spooler
    Apr 27, 2018 at 17:21
  • @Spooler what do you mean by breaking out of user shell to something more powerful with PHP? I assume nobody runs PHP as suid binary.
    – AlexD
    Apr 27, 2018 at 17:34
  • 2
    "I assume..." In a security context, this almost always ends poorly.
    – EBGreen
    Apr 27, 2018 at 17:42
  • Avoiding assumptions is a good point. If we're talking about security we should at least attempt to stay real even when mostly hypothetical. I certainly didn't make a great effort of that in my answer. @AlexD I've only seen that once, and it was genuinely shocking. Aside from that, I'm not personally aware of any escalation paths that don't involve zebras.
    – Spooler
    Apr 27, 2018 at 18:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .