run Python file with root permission via php

Question

I'm trying to run Python file with root access with php index

in php there is :

passthru('python /home/register/register.py '. $_POST['username'] . ' example.com ' . $_POST['password'] . ' ' . $_POST['email'] . ' ' . $ip . ' 1 2>&1');

and in Python file there is:

os.popen("sudo -u root -p password /sbin/ejabberdctl register %s %s %s" % (user,domain,password)).read()

is there any command with Python to login with root user then do command like : ls or mkdir

thnx.

• Padraic Cunningham: Yes, using subprocess
• deounix: @PadraicCunningham How can I do it ?
• mata: you should look into how to use a sudoers policy to allow the user to execute commands as root. Also, the way you process the arguments is very dangerous and allows for shell injection (for both the call in PHP and python)!
• deounix: @mata are there any command with python to login with root, and use password to login
• Martin Tournoij: Passing in $_POST variables without any sanitation to Python (and then to sudo! Again without sanitation) is a huge security hole.

Answer 1

from subprocess import PIPE,Popen
p = Popen(["sudo", "-s", "-S"], stdin=PIPE, stdout=PIPE, universal_newlines=True)
p.stdin.write("password\n")
p.stdin.write("mkdir foo\n")
p.stdin.write("id -u")

To see output use communicate:

from subprocess import PIPE,Popen
p = Popen(["sudo", "-s", "-S"], stdin=PIPE, stdout=PIPE, universal_newlines=True)
p.stdin.write("password\n")
p.stdin.write("ls -la\n")
p.stdin.write("/usr/bin/pip list\n")
p.stdin.write("id -u")
print(p.communicate()[0])

But be very sure you know what commands you are running.

• deounix: Traceback (most recent call last): File "test.py", line 6, in <module> p = Popen(["sudo","-s","-S"],stdin=PIPE, stdout=PIPE,cuniversal_newlines=True) TypeError: __init__() got an unexpected keyword argument 'cuniversal_newlines'
• Padraic Cunningham: I had a typo, it has since been fixed, should not have c before universal
• deounix: ok in p.stdin.write("password\n") am should to write my root password Right ??
• deounix: it's return to me with this error : None None [sudo] password for apache
• deounix: p.stdin.write("/sbin/ejabberdctl register user example.com 123456\n")

Answer 2

I recently published a project that allows PHP to obtain and interact with a real Bash shell (as user: apache/www-data or root if needed). Get it here: https://github.com/merlinthemagic/MTS

After downloading you would simply use the following code:

//Setting the second argument in getShell():
//true will return a shell with root
//false will return a shell with the php execution user
$shell = \MTS\Factories::getDevices()->getLocalHost()->getShell('bash', true);
$return1 = $shell->exeCmd("mkdir -p /some/path");
$return2 = $shell->exeCmd("ls --color=none /some/path");

notice the ls command has a switch called --color=none, that is needed because the bash shell will return color information as odd chars, the switch prevents it.