disable perl suphp

[tincboy]

I've find a shell on one of my hosted domains today which was uploaded via a wordpress bug,
In the shell it says the perl is active on my server and can be used, how can I find out if it's true? and how can I disable it while using suphp?

 

[abolfazl201358]

perl command to limit

chmod 705 /usr/bin/perl

 

[tincboy]

I don't think it works on suPHP, it only works with php_cli

 

[abolfazl201358]

I don't think it works on suPHP, it only works with php_cli

that it was OK for us and with the same command

 

[zEitEr]

I don't think it works on suPHP, it only works with php_cli

What does perl have to do with suPHP? Is downloaded PHP shell executing perl commands with system()/exec() ? If so, then you might need to disable them in php.ini globally or on per user bases.

 

[chatwizrd]

perl command to limit

chmod 705 /usr/bin/perl

It should be chmod 750 /usr/bin/perl not 705

 

[tincboy]

I've tried both of them but the shell still says Perl is ON.

 

[Richard G]

@Chatwizrd: You're wrong, it should be 705, not 750.
http://help.directadmin.com/item.php?id=247

chgrp apache /usr/bin/perl
chmod 705 /usr/bin/perl

Perl is still active but users should not be able to use it anymore.

 

[chatwizrd]

@Chatwizrd: You're wrong, it should be 705, not 750.
http://help.directadmin.com/item.php?id=247

chgrp apache /usr/bin/perl
chmod 705 /usr/bin/perl

Perl is still active but users should not be able to use it anymore.

Haha that definitely is a half assed way of doing it. I am sure there are way better ways to prevent users from using it.

 

[tincboy]

I've disabled many functions in php.ini and they are now blocked, but the shell is showing Perl is On and I guess it's dangerous `cause Perl can be used to execute abusive code.

 

[zEitEr]

Hmm, you should really try to execute any perl script in public_html (trigger it from browser)... and see whether or not it will run.

The php shell script (which you are referring to) might be checking only existence of perl binary... and I would not trust such a script.

 

[DirectAdmin Support]

If you want to block perl from many Users, create some group called (for example):
noperl

And set the perl binary to root:noperl 705.
Add any Users who should not have perl access to the noperl group.

John

 

[tincboy]

any code sample to test if users has access to perl ?

 

[zEitEr]

#!/usr/bin/perl
print "Content-type: text/html\n\n";
print "<H1>Hello World</H1>\n";

http://www.troubleshooters.com/codecorn/littperl/perlhelo.htm

 

[tincboy]

I've put the code into a test.pl file with 644 permission and right owner,
using browser to execute that file only shows the source code, in both cgi-bin and outside of it,
Is this the right way to run a Perl script via httpd ?

 

[chatwizrd]

Perl files would need to be in the cgi-bin folder. What extension are you using on your files. You will have to end them in .cgi or create an .htaccess in your public_html folder with AddHandler cgi-script .pl

They also need to be executable so they would have to be chmod 750 or 755

 

[Arieh]

I'm not 100% sure about it but I believe cgi stuff works everywhere.. do a httpd -l | grep cgi

Ive disabled them all

"--disable-cgid" \
"--disable-cgi" \
"--disable-proxy-scgi"

@ /usr/local/directadmin/custombuild/custom/ap2/configure.apache

also keep in mind everything done by cron job is like ssh, so if you want to catch perl the chmod would be the way as it can be reached past apache

 

[tincboy]

I've renamed it to .cgi and now I got error 500
In Apache logs I can see the error of "Premature end of script headers: test.cgi"
What does it mean? Was it successful for blocking Perl?
Because of cron jobs I guess blocking Perl via permissions would be better than recompiling httpd, right? ( I also run php_cgi so the crons are being run with proper user owner )

 

[zEitEr]

Do set chmod 755 on perl and check whether the error disappears:

chmod 755 /usr/bin/perl

if yes, then chmod back to 705:

chmod 705 /usr/bin/perl

In this case it would mean, that you've got perl disabled.

 

[tincboy]

I see the same error with both permissions