Search the Community

Sorry if i posted this in the wrong place but i dident see anthing about Active Directory or Security Questions But has anyone used Active Directory as their User Database? Has anyone even tryed braking Active Directory with injection attacks? Notes that i have found so far: Php Sends to CMD first so encode userdata in base64 as a transport layer $rand is a random number to prevent users from useing Success: as a ligitimate user You will need to clean up the many many spaces that powershell sends back as it is a concole Special Charicters dont need to be escaped I am using Win 2008 RC2 Apache PHP (of course) Powershell Active Directory PHP Script $psScriptPath = 'C:/Apache/PSScripts/' //Path outside Website Root $rand = mt_rand(mt_getrandmax(),mt_getrandmax()); //UTF-8 Standard only $username = utf8_decode($_POST["username"]); $password = utf8_decode($_POST["password"]); $base64_username = base64_encode($username); //Transport Layer Base64 $base64_password = base64_encode($password); //Transport Layer Base64 //The danger happens here as it is sent to powershell. $query = shell_exec('powershell.exe -ExecutionPolicy ByPass -command "' . $psScriptPath . '" < NUL -rand "' . $rand . '" < NUL -base64_username "' . $base64_username . '" < NUL -base64_password "' . $base64_password . '" < NUL');// Execute the PowerShell script, passing the parameters Powershell Script #*============================================================================= #* Script Name: adpwchange2014.ps1 #* Created: 2014-10-07 #* Author: #* Purpose: This is a simple script that queries AD users. #* Reference Website: http://theboywonder.co.uk/2012/07/29/executing-powershell-using-php-and-iis/ #* #*============================================================================= #*============================================================================= #* PARAMETER DECLARATION #*============================================================================= param( [string]$base64_username, [string]$base64_password, [string]$rand ) #*============================================================================= #* IMPORT LIBRARIES #*============================================================================= if ((Get-Module | where {$_.Name -match "ActiveDirectory"}) -eq $null){ #Loading module Write-Host "Loading module AcitveDirectory..." Import-Module ActiveDirectory }else{ write-output "Error: Please install ActiveDirectory Module" EXIT NUL Stop-Process -processname powershell* } #*============================================================================= #* PARAMETERS #*============================================================================= $username = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($base64_username)) $password = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($base64_password)) #*============================================================================= #* INITIALISE VARIABLES #*============================================================================= # Increase buffer width/height to avoid PowerShell from wrapping the text before # sending it back to PHP (this results in weird spaces). $pshost = Get-Host $pswindow = $pshost.ui.rawui $newsize = $pswindow.buffersize $newsize.height = 1000 $newsize.width = 300 $pswindow.buffersize = $newsize #*============================================================================= #* EXCEPTION HANDLER #*============================================================================= #*============================================================================= #* FUNCTION LISTINGS #*============================================================================= Function Test-ADAuthentication { Param($Auth_User, $Auth_Pass) Write-Output "Running Function Test-ADAuthenication" $domain = $env:USERDOMAIN Add-Type -AssemblyName System.DirectoryServices.AccountManagement $ct = [System.DirectoryServices.AccountManagement.ContextType]::Domain $pc = New-Object System.DirectoryServices.AccountManagement.PrincipalContext($ct, $domain) $pc.ValidateCredentials($Auth_User, $Auth_Pass).ToString() } #*============================================================================= #* SCRIPT BODY #*============================================================================= Write-Output $PSVersionTable Write-Output " " $authentication = Test-ADAuthentication "$username" "$password" if ($authentication -eq $TRUE) { Write-Output "Success:$rand Authentication" }elseif ($authentication -eq $FALSE) { Write-Output "Failed:$rand Authentication" }else { Write-Output "Error: EOS" EXIT NUL Stop-Process -processname powershell* } #*============================================================================= #* SCRIPT Exit #*============================================================================= Write-Output "End Of Script" EXIT NUL Stop-Process -processname powershell*

Hi I am trying to search an array that comes from a power shell script, the array of strings that returns is ever changing as it receives variables from the script. Therefore I need to use preg_grep to search for the word "not" I am also using another array which inverts this I then need to compare these new two arrays to the original and separate the results $working and not working into a table. I would be most grateful for any advice/solutions. The preg_grep aren't displaying anything. <?php //phpinfo(); ini_set('display_errors', 'On'); error_reporting(0);//E_ALL echo '<html> <style> body { font-family:Calibri,Helvetica,sans-serif; font-size:100%; } </style> <head> <link rel="stylesheet" type="text/css" href="style.css"> <script type="text/javascript"> function uploadJS(){ String.prototype.trim = function() { return this.replace(/^\s+|\s+$/g, ""); }; var textAreaValue=document.getElementById(\'ServerList\').value; var trimmedTextAreaValue=textAreaValue.trim(); if(trimmedTextAreaValue!="") { document.myForm.submit(); } else{ alert("Server List Text Area is Empty"); } }; var input=document.getElementById(\'fileSelect\').value; if(input!="") { document.myForm.submit(); } else{ alert("You have not selected a file, please select one to proceed."); } var handleFileSelect = function(e) { var files = e.target.files; if(files.length === 1) { document.forms.myForm.filecsv.value = files[0].name; } } }; </script> </head>'; #Upload Code $target = "D:\Web\Upload/"; $target = $target . basename( $_FILES['uploaded']['name']) ; $ok=1; if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target)) { echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded"; } else { } if ($uploaded_size > 150000) { echo "Your file is too large.<br>"; $ok=0; } if ($uploaded_type =="text/php") { echo "No PHP files<br>"; $ok=0; } if (!($uploaded_type=="text/csv")) { echo "<br>"; $ok=0; } $target = "upload/"; $target = $target . basename( $_FILES['uploaded']['name']) ; $ok=1; //This is our size condition if ($uploaded_size > 350000) { echo "Your file is too large.<br>"; $ok=0; } //This is our limit file type condition if ($uploaded_type =="text/php") { echo "No PHP files<br>"; $ok=0; } //Here we check that $ok was not set to 0 by an error if ($ok==0) { } //If everything is ok we try to upload it else { if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target)) { echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded"; } else { } } #Start of scripts to check Servers in textbox if(isset($_POST['ServerList'])) { //$arry=explode( "\r\n", $_POST['ServerList'] ); $txttrim = trim($_POST['ServerList']); //$textAr = explode("\n", $text); //$textAr1 = array_filter($text, 'trim'); // remove any extra \r characters left behind $txtarea = explode("\n",$txttrim); $txtarea = array_filter($txtarea,'trim'); foreach ($txtarea as $line => $servername) { //$line => $servername; ##check if querying itself.... } echo '<pre>'; $target="D:/Web/Upload/"; $target= $target . basename( $_FILES['uploaded']['name']) ; $csv = $target; //$filename= $_FILES['uploaded']['name']; $output=shell_exec("powershell -Command D:/Web/scripts/PHPfwrules.ps1 $csv < NUL"); echo '<h6>'; print_r($output); $nomatch=preg_grep('/^not/i',$output); echo $nomatch; $match=preg_grep("/not/",$output,PREG_GREP_INVERT); echo $match; if ($working1= array_intersect($output,$match)) { echo"<link rel=stylesheet type=text/css href=style.css> <table class=results> <tr> <th>Server Name</th> <th>Working</th> </tr> <tr> <td>".$servername."</td> <td>".$working1."</td> </tr></table> "; } else if ($notworking1= array_intersect($output,$nomatch)) { echo"<link rel=stylesheet type=text/css href=style.css> <table class=results> <tr> <th>Server Name</th> <th>Not Working</th> </tr> <tr> <td>".$servername."</td> <td>".$notworking1."</td> </tr></table> "; } } echo' <link rel=stylesheet href=dhtmlwindow.css type=text/css /> <link rel=stylesheet type=text/css href=style.css> <script src=js/dhtmlwindow.js></script> <hr /> <table class=results> <tr> <th>Server Name</th> <th>Working</th> <th> Not Working</th> </tr> <tr> <td>'.$servername.'</td> <td>'.$working1.'</td> <td>'.$notworking1.'</td> <td></td> '; echo '</pre>'; echo ' <h3>Firewall Implementation </h3> <h4>Please enter the server below, you can only select one server at a time. </h4> <!--The form--> <form action="fw2.php" method="post" name="myForm" id="myForm" enctype="multipart/form-data"> <textarea name=ServerList id=ServerList> </textarea> <h5>Please select a CSV file.</h5> <input name="uploaded" type="file" /><br /> <input type="submit" value="Submit" /> <br> </html> ' ; ?> Here is the power shell script: #### Set Parameter for the input filename #### Param( [Parameter( # Mandatory = $true, ParameterSetName = '', ValueFromPipeline = $true)] [array]$Filename ) #### Check if files already exist #### if (test-path c:\ec\company\ports\working.txt) { Remove-item c:\etc\company\ports\working.txt } if (test-path c:\etc\company\ports\NOTworking.txt) { Remove-item c:\etc\company\ports\NOTworking.txt } #### Create Directory if it does not exist #### if ((test-path c:\etc\company\ports) -eq $false) { New-Item -ItemType directory -Path C:\etc\company\Ports } #### Output filenames #### #### Declaring the failure variable as an array #### $failure = @() $computer = gc env:computername $outputfileworking = "C:\etc\company\ports\working.txt"; $outputfileNOTworking = "C:\etc\company\ports\NOTworking.txt"; #### Output servername to the output file #### echo "ServerName:$computer" | out-file -filepath $outputfileworking $path = "$Filename" $csv = Import-csv -path $path ForEach($line in $csv) { $destination = $line.destination $protocol = $line.protocol $port = $line.port $result = ./portqry.exe -n $destination -e $port -p $protocol if ($result -like "*: LISTENING*") { Echo "$destination is reachable on port $port using $protocol" } else { Echo "$destination is not reachable on port $port using $protocol" } } if ($failure) { echo "ServerName:$computer" | out-file -filepath $outputfileNOTworking echo $failure | out-file -filepath $outputfileNOTworking -append }

<?php error_reporting(E_ALL); $psPath = "powershell.exe"; $psDir = "C:\\wamp\\www\\ps\\"; $psScript = "SampleHTML.ps1"; $runScript = $psDir. $psScript; $prem = "-Action enable"; $runCMD = $psPath. " " .$runScript. " " .$prem; //var_dump($runCMD); $output = exec($runCMD); echo $output; ?> Hello, I am working on a small project to get results from powershell script by using PHP. For some reason in PHP logs I get Exec unable to fork. Above is the script I wrote to execute powershell script within php. My webserver is IIS 7, and app pool is using a domain user that has full rights for Powershell to execute and get remote server results.

Hello: I have been developing a web tool to perform basic maintenance to 100's of MacOS units, which at this point it works fantastic. Now I am faced with the task of integrating 350 units in windows. The need is to send commands through powershell. I have tried to use system(), exec(), shell_exec() and have not been successful. The drop that spilled the cup this morning was... I sent a "reboot -r -t 01" command to a windows server hoping that it would perform a PSSession to a different non critical server, but to my surprise... You guessed it... I rebooted a production Server ... I am new to Powershell so I am not as fluent on it... But I am sure that it does not matter if you use a MacOS or a Windows or a Unix PHP server... the commands should be sent the same way and not platform dependent... Correct? Or is it that PHP needs a Powershell module installed such as ssh2?? As an example... How can I send a command to a Windows Unit from a php command? Let's say: shell_exec('powershell"Invoke-Command -ComputerName WindowsUnit1 -ScriptBlock { Get-Service dhcp } -Credential $Credentials"'); I have been getting the server to hang when trying to send this through a Windows based PHP server. I have added the "< NUL 2>&1" option at the end to get some feedback as well. On a MacOS based PHP server, the $credentials variable is unset, so.. in order for me to set the credentials, how can I do so? I hope someone here has faced this before and can shed some light my way. Thanks Hiroshi T