screwy/incorrect behavior in PHP script
I have some PHP code that is supposed to invoke a bash script and it doesn't seem to be working. The basic idea is that it is pulling down an HTML file, scanning it with clamscan, and then reporting whether or not an infection is found in the source code. Not perfect but it doesn't have to be. The shell script is as follows:
Code:
#!/bin/bash
in=/tmp/foo.html
outfile=/tmp/clamscan.txt
cd ~/bin
addr=$(java ParseURL "$*")
w3m -dump_source ${addr} | clamscan - > ${outfile} 2>&1
infected=$(grep "Infected files" ${outfile} | tr -s ' ' | cut -d ' ' -f 3)
exploit=$(grep "FOUND" ${outfile})
if [ -n "$exploit" ]; then
echo "infected"
elif [ -n "$infected" ]; then
if [ $infected -gt 1 ]; then
echo "infected"
else
echo "clean"
fi
else
echo "clean"
fi
rm -rf $in
rm -rf $outfile
Just FYI, the Java class will parse a string and pull out only the URL from it based on some regular expressions. So if I pass in the string "hello my name is www.ebay.com and I like to sell stuff" the Java program would return only the string "www.ebay.com".
What is silly is that I can run the above shell script manually and it will output the correct answer:
Code:
$ ./friend-scan is testing http://www.xxx.xxx/exp2.html
infected
However, if I call the exact same command from my PHP code it prints "clean". Here is the PHP code (and at this particular point, the variable $msg is the string "is testing http://www.xxx.xxx/exp2.html"):
Code:
// run clam-scan on the target HTML file
$command = "/home/bdmayes/bin/friend-scan $msg";
echo "Calling $command <br>";
$myOutput=shell_exec($command);
echo "<pre>$myOutput</pre>";
and here is the output from the resulting HTML page:
Code:
Calling /home/bdmayes/bin/friend-scan is testing http://www.xxx.xxx/exp2.html
clean
I have done some testing by adding the following code to my shell script:
Code:
testFile=/tmp/addr.txt
echo "$*" >> $testFile
echo "$infected" >> $testFile
echo "$exploit" >> $testFile
echo "" >> $testFile
and what I found is that when my PHP code calls the friend-scan script, the variable $exploit seems to be null. Also, it finds zero infections:
Code:
$ cat /tmp/addr.txt
is testing http://www.xxx.xxx/exp2.html
0
If I run this exact same script manually it finds an infection!
Code:
$ cat /tmp/addr2.txt
is testing http://www.xxx.xxx/exp2.html
1
stdin: Exploit.CVE-2006-3730 FOUND
How is this possible? Anybody have an idea what is going on here? (bwkaz -- I'm looking in your direction ;) )
