Running shell script as root from php page

[edlemmers]

Hello,

I have successfully created a php file that using the WHM API to create an account. I also have a collection of shell and perl scripts that created a while back that install a CMS into an account. I have been running these scripts thru SSH as root for a long time. What I would like to do is run that script as root from a php page using the CPanel account created in the script that uses the WHM API. How would I go about doing this?

Thanks!

 

[cPanelMichael]

I have been running these scripts thru SSH as root for a long time. What I would like to do is run that script as root from a php page using the CPanel account created in the script that uses the WHM API.

Hello,

Could you provide a more specific example of this, and more information on what you are attempting to accomplish?

Thank you.

 

[edlemmers]

Hello,

Could you provide a more specific example of this, and more information on what you are attempting to accomplish?

Thank you.

With the WHM API, you can access the WHM features by building a URL of the form:

https://hostname.example.com:2087/cpsess##########/json-api/somekeyword?someparamname=somevalue&etc=etc

https://hostname.example.com:2087/cpsess##########/json-api/adddns?domain=example.com&ip=192.168.0.20
and then simply directing to this URL, or setup AJAX POST, or use a cURL operation to POST. One thing that would work very nicely is if I could setup my own keyword to run my custom script through this API interface. I would then be able to run my script with very high privileges while taking advantage of the security of the API system. If it is not possible to do this, is there some other way to run shell scripts as root through a web pages of some sort?

 

[edlemmers]

Another possible way to do what I need to do: How would I run my script from the post hook in createacct?

Thanks

 

[Islandhosting]

I might misunderstand what you're asking, but cPanel plugins (PHP or not) can't run scripts as root or any other UID besides that of the user who is using the plugin, as far as I know. This makes a lot of sense security-wise.

cPanel's APIs do provide a way to call routines with escalated privileges though:

Guide to API Privilege Escalation