Re: [PHP] Create .php file with php [POC CODE INCLUDED]

2007-06-27 Thread Crayon Shin Chan
On Wednesday 27 June 2007 06:32, Edward Vermillion wrote: > Most /tmp directories are world rwx. So anyone that can log into the > server through a shell, or any account running on the server, has at > least read access to anything in the /tmp directory. They wouldn't > need to do it through a web

Re: [PHP] Create .php file with php [POC CODE INCLUDED]

2007-06-26 Thread Adam Schroeder
... if you really couldn't write it as dynamic PHP -- you could also save it in a database. Edward Vermillion wrote: On Jun 26, 2007, at 3:31 PM, Crayon Shin Chan wrote: On Wednesday 27 June 2007 03:53, Daniel Brown wrote: On 6/26/07, Al Rider <[EMAIL PROTECTED]> wrote: I think most sy

Re: [PHP] Create .php file with php [POC CODE INCLUDED]

2007-06-26 Thread Edward Vermillion
On Jun 26, 2007, at 3:31 PM, Crayon Shin Chan wrote: On Wednesday 27 June 2007 03:53, Daniel Brown wrote: On 6/26/07, Al Rider <[EMAIL PROTECTED]> wrote: I think most systems have a /tmp directory above the web dir, so outsiders can't watch it anyhow. True, but on an unsecured box, this

Re: [PHP] Create .php file with php [POC CODE INCLUDED]

2007-06-26 Thread Daniel Brown
On 6/26/07, Crayon Shin Chan <[EMAIL PROTECTED]> wrote: On Wednesday 27 June 2007 03:53, Daniel Brown wrote: > On 6/26/07, Al Rider <[EMAIL PROTECTED]> wrote: > > I think most systems have a /tmp directory above the web dir, so > > outsiders can't watch it anyhow. > > True, but on an unsecure

Re: [PHP] Create .php file with php [POC CODE INCLUDED]

2007-06-26 Thread Crayon Shin Chan
On Wednesday 27 June 2007 03:53, Daniel Brown wrote: > On 6/26/07, Al Rider <[EMAIL PROTECTED]> wrote: > > I think most systems have a /tmp directory above the web dir, so > > outsiders can't watch it anyhow. > > True, but on an unsecured box, this becomes possible, as Apache > will most likely

Re: [PHP] Create .php file with php [POC CODE INCLUDED]

2007-06-26 Thread Daniel Brown
On 6/26/07, Al Rider <[EMAIL PROTECTED]> wrote: I think most systems have a /tmp directory above the web dir, so outsiders can't watch it anyhow. True, but on an unsecured box, this becomes possible, as Apache will most likely be running universally as `nobody`, `httpd`, `apache`, or `daemon