1

I need to perform a TCP traceroute using either the Linux traceroute or another package, but I'm struggling to find a way of making the request from PHP without needing sudo privileges.

Because the URL will be from a user request I don't want to use sudo.

Here's an example:

 $url = 'ebay.com';
 $exec = 'sudo traceroute -w 1 -q 1 -T ' . $url;
 $escaped_command = escapeshellcmd($exec);
 $result = shell_exec($escaped_command);

 echo $result;
 var_dump($result);

This code works, but only with sudo or without -T. Without sudo, it returns an empty string. Without -T the traceroute does not survive firewalls.

If it helps, I'm on a Centos 7 OS.

Note: I can't use UDP instead of TCP because it often gets blocked by the destination firewall.

migrated from security.stackexchange.com Oct 15 '18 at 19:03

This question came from our site for information security professionals.

  • A few considerations when using escapeshellcmd() gist.github.com/Zenexer/40d02da5e07f151adeaeeaa11af9ab36 – Daisetsu Oct 15 '18 at 18:47
  • @schroeder: -T is short for -M tcp and this method is documented as using half-open connections by default and thus needs root. It is not written explicit in the man page but there is nothing written about needed permissions at all. Probably with the (explicitly not recommended) option tcpconn it will not need root since then it is doing a simple connect. – Steffen Ullrich Oct 15 '18 at 18:56
  • Thanks Steffen, so in that case probably with UDP and increasing the TTL can be done, however the sender needs to read the ICMP generated by the routers, so in this case I think the source application needs root permisions for read the ICMP Unreach generated, I think – camp0 Oct 15 '18 at 19:02
  • @camp0 the OP says it works without sudo and without -T – schroeder Oct 15 '18 at 19:02
  • I think @SteffenUllrich has the ultimate answer, and this is far more of a Linux question than a security question. – schroeder Oct 15 '18 at 19:03
0

You cannot run sudo from PHP, since Apache will not let you do that for security reasons. You need to implement traceroute in PHP inside your code.

There are several such implementations to be found in the public domain.

See for example:

Creating a traceroute program in PHP, code is available on github.


Another approach to avoid sudo for traceroute based on the fact that traceroute needs not run as root; it just needs the capability CAP_NET_ADMIN. To set this as file capability for all users, if your kernel supports file capabilities and no Linux Security Module (SELinux, AppArmor) is blocking it:

setcap CAP_NET_ADMIN+ep /usr/sbin/traceroute

The PHP code can then be very simple using popen():

$handle = popen("traceroute www.xxx.com 2>&1", "r");
while(!feof($handle)) {
    $buffer = fgets($handle);
    $buffer = "<p>".$buffer."</p>\n";
    echo $buffer;
}
pclose($handle);
  • I'm using Nginx, so I can run sudo, but it's not safe. The PHP implementation you linked also requires sudo and uses UDP not TCP which is what I need. . – turrican_34 Oct 16 '18 at 11:14
  • As an Nginx person, perhaps you can explain to me why sudo is necessary for sending messages on sockets. – harrymc Oct 16 '18 at 12:44
  • According to a SO thread I found Opening a raw socket allows to read anything that is received in a given interface, so, basically, you can read any packet that is directed to any application - even if that application is owned by another user. That basically means that the user with this capability is able to read any and all communications of all users.. stackoverflow.com/questions/4404860/… – turrican_34 Oct 16 '18 at 13:13
  • Right, so I added another approach. – harrymc Oct 16 '18 at 13:42
  • That did it! Thanks. Strangely, I didn't need cap_net_admin it worked with onlycap_net_raw like sudo setcap cap_net_raw+ep /usr/bin/traceroute. If I run getcap /usr/bin/traceroute I get /usr/bin/traceroute = cap_net_raw+ep. I have selinux in permissive mode at the moment, so once I enable it I guess I'll have issues to fix. – turrican_34 Oct 17 '18 at 11:29

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.