GrizPwnz GrizPwnz - 2 months ago 9
Bash Question

PHP run shell command with multible arguments on an HTML forum

I'm new to PHP but I want to see if something like this is possible. I have to run a shell command with multiple arguments that you can change on an HTML forum like such.




<html>
<body>
<form method="POST" action="">
<input type="text" name="cmd1">
<input type="text" name="cmd2">
<input type="text" name="cmd3">
<input type="text" name="cmd4">
<input type="submit" value="Submit">
</form>
</body>
</html>




It has to run a shell command for example -




shell_exec('example $cmd1, $cmd2, $cmd3, $cmd4')




I do not understand much PHP but is something like this possible? And if it is, how would I be able to do this? Thank you!

Answer

You are missing the hook between the $_POST variables and your variables $cmd1, $cmd2, $cmd3, and $cmd4

These can be assigned like so:

$cmd1 = $_POST['cmd1'];
$cmd2 = $_POST['cmd2'];
$cmd3 = $_POST['cmd3'];
$cmd4 = $_POST['cmd4'];

Then you need to also be aware of how things are concatenated in PHP, which is by using a . so your shell_exec example:

shell_exec('example $cmd1, $cmd2, $cmd3, $cmd4');

Should be written like this:

shell_exec('example '.$cmd1.', '.$cmd2.', '.$cmd3.', '.$cmd4');

WARNING: EXECUTING SHELL COMMANDS FROM WEB SUBMITTED CONTENT CAN BE VERY UNSAFE IF YOU DO NOT PROPERLY CHECK THE VARIABLES BEFORE EXECUTING THE SHELL SCRIPT!