What to check when shell_exec() does not work?

Notaras 0
Viewed 35

I have the following code running in an application on IIS:

<?php
    echo "begin test";
    $temp = shell_exec('whoami 2>&1');
    print_r($temp);
    echo "<br/>end test";
?>

This outputs:

begin test
end test

This means that shell_exec did not execute. Additionally no exception was thrown, nor was there any warning outputted.

What do i need to check to ensure this executes properly?

Edit: disable_functions in php.ini is blank

shell-exec iis permissions shell php
2 Answers

The first thing I would do is open your php.ini file and find the part labeled disable_functions. Make sure that the list of disabled functions does not include shell_exec. You can also dump this information to a browser screen via phpinfo. That has the advantage of allowing you to do a ctrl-f for shell_exec. (Be sure to turn the dump off again once you've grabbed what you need.)

In any case, if you're enabling shell_exec on a server where it was disabled, proceed with extreme caution, especially if you're sharing the environment with others. There is likely a very good reason why it's turned off. For example, it's common for popular packages to have vulnerabilities discovered, and a shared hosting admin who can't convince their boss to ban said packages might disable shell_exec as a way to temporarily allow clients to keep running those insecure packages until the packages have actual fixes. For obvious reasons, turning shell_exec back on could be extremely dangerous.

Anyhow, I hope this helps.

Mayor of the Plattenbaus0

The issue turned out to be something to do with the PHP version. Updating from PHP 5 to PHP 8 resolved the issue.

Notaras0
Related