|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2004-01-26 15:41 UTC] ghoffer at globalscape dot com
Description: ------------ (Related to Bug #10065, but slightly different and more detailed ) Environment: Win2K3 running PHP 4.3.4 under FastCGI. PHP.INI has "fastcgi.impersonate=1". IIS Site has "Anonymous Access" OFF and "NT Authentication" ON (so that you have to log in to the site as an NT User). Up to this point, all is fine: the NT user is being impersonated by the main thread of PHP so that file access permissions are handled properly. HOWEVER, if the PHP script attempts to execute a command (using exec, or passthru, or similar) then that spawned process is NOT impersonating the NT account, but rather running under the IIS account. SUGGESTED RESOLUTION: in proc_open.c, the proc_open function can make a few calls in lieu of "CreateProcess" in order to "pass along" the Impersonation. Instead of CreateProcess, it should use "CreateProcessAsUser," passing in the token of the impersonated user (which PHP is running under). If it does not do this, per the Win32 API docs, CreateProcess simply uses the non-impersonated token. Here is how to run a spawned process as the impersonated user (which CAN be done conditionally when impersonation is necessary (e.g., "LOGON_USER" is defined; but doing it ALWAYS should in no way impair security, only a slight hit in performance as three additional API calls are made): [ Error checking and variable declarations omitted ] OpenThreadToken( GetCurrentThread(), TOKEN_ALL_ACCESS, TRUE, &hToken ); // get impersonation token DuplicateTokenEx( hToken, MAXIMUM_ALLOWED, &sa, SecurityImpersonation, TokenPrimary, &hToken2 ); // duplicate it for passing to CreateProcessAsUser CreateProcessAsUser( hToken2, ... ) // rest of params are the same as CreateProcess // . . . CloseHandle( hToken2 ); CloseHandle( hToken ); Reproduce code: --------------- <?php # run this under FastCGI (with "fastcgi.impersonate=1" in PHP.INI # with NT Auth access to the Virtual Site / Dir that houses the script. # DOIT.bat can be any batch file. For example, have the batch file attempt to write a new file to a folder that # has ONLY write permissions for the logged-inNT User, NOT the IWAM account. # It will fail because cmd.exe is being executed as IWAM_* even though # we logged into the website and properly impersonated another user. $last_line = @exec("cmd.exe /c doit.bat"); ?> Expected result: ---------------- PHP running as impersonated user under FastCGI should spawn processes with security context of that impersonated user. Actual result: -------------- The spawned process is being executed in the security context of the IIS account (IWAM_*). PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Fri Nov 07 18:00:01 2025 UTC |
Ok, it works on the commandline but not using IIS6 and fastcgi with fastcgi.impersonate = 1;. This is test.php: <?php $out = array(); echo exec("echo %USERNAME%", $out); print_r($out); $out = array(); echo exec("echo %USERPROFILE%", $out); print_r($out); ?> and this results in: %USERNAME%Array ( [0] => %USERNAME% ) C:\Documents and Settings\Default UserArray ( [0] => C:\Documents and Settings\Default User ) So it seems the user's profile/environment is not correctly set up. I think username should be either domain\deabjs1 or just deabjs1, because this is what I use to log on to IIS using NTLM. I'm still using the same snapshot I was using at [6 Sep 6:13pm UTC]. Thanks for your help! benHope I'm not too verbose. Maybe it helps to see that calling this exec("d:/programme/imagemagick/convert.exe -density $density $baseDirectory/$bookId/document.pdf -quality 95 $baseDirectory/$bookId/$version/page_%04d.jpg", $output); print_r($output); in a script run by the webserver (as above) causes this: Array ( [0] => Error: /invalidfileaccess in --showpage-- [1] => Operand stack: [2] => --nostringval-- 1 true [3] => Execution stack: [4] => %interp_exit .runexec2 --nostringval-- --nostringval-- --nostringval-- 2 %stopped_push --nostringval-- --nostringval-- --nostringval-- false 1 %stopped_push 1905 1 3 %oparray_pop 1904 1 3 %oparray_pop 1888 1 3 %oparray_pop --nostringval-- --nostringval-- 2 1 4 --nostringval-- %for_pos_int_continue --nostringval-- --nostringval-- 1777 1 9 %oparray_pop --nostringval-- --nostringval-- [5] => Dictionary stack: [6] => --dict:1155/1684(ro)(G)-- --dict:1/20(G)-- --dict:75/200(L)-- --dict:75/200(L)-- --dict:106/127(ro)(G)-- --dict:275/300(ro)(G)-- --dict:22/25(L)-- --dict:4/6(L)-- --dict:22/40(L)-- [7] => Current allocation mode is local [8] => Last OS error: Bad file descriptor )I am using a simple test script to do the test: <?php echo exec('cmd /c echo Hello World!'); ?> FastCGI impersonation: In PHP.ini fastcgi.impersonate = 1 IIS: Anonymous Authentication = On User is same user as Application Pool user User has been added to IIS_WPGThis is what I ran: <?php echo exec('c:\Windows\System32\whoami'); ?> ProcMon shows cmd.exe being started by php-cgi.exe A thread is created running as the correct user. Excecuted command is: cmd.exe /c "c:\Windows\System32\whoami" I do notice that the process exits with Exit Status 5, which is normally access denied. I have however already tried to give Everyone full access to the whole machine, i.e. all drives. Still the same error.echo exec('c:\Windows\System32\whoami'); can't work. echo exec('c:\\Windows\\System32\\whoami'); should work.