LOGIN REGISTER SEARCH MY INBOX FORUMS» Home» All Articles» Trouble Shooting. » reply

Transcription

1 Page 1 of 6 Page 1 of 6 LOGIN REGISTER SEARCH MY INBOX HOME ARTICLES FORUMS» DOWNLOADS WEBLINKS Home» All Articles» Trouble Shooting» reply

2 Page 2 of 6 Page 2 of 6 Articles Trouble Shooting (9) How To Guides (43) IIS-Aid News (76) Interviews (2) Site Updates (4) My Word (32) Performance Testing (7) Reviews (2) (3) FastCGI (1) IIS (37) Monitoring (1) MySQL (7) PHP (23) Windows (7) Warning: exec() [function.exec]: Unable to fork Submitted by on Wed, :00. Categories: Trouble Shooting PHP One of the most common ways a PHP application will try and launch an external program is to use the exec function. However, if you are trying to use a script using this exec function and you are an IIS user using the default anonymous IIS user account then you'll almost certainly experience the Warning: exec() [function.exec]: Unable to fork error. This is because by default the anonymous IIS user account has minimal access to your system, and in particular every executable file in your Windows system32 directory are explicitly set to deny access to this account. Now that we know why you get this error, lets see if we can get a working solution. Most scripts that use the exec function are trying to get access to the command line interpreter, so in this example we'll look at how we can give PHP access to the cmd.exe executable. The utility we'll use here is called cacls.exe which is a very handy utility that comes with Windows that allows you to display and modify access control lists on files and folders. First off, lets have a look at the standard ACL for the cmd.exe file in the Windows system32 directory. To do this open a command prompt and type in; cacls %COMPSEC% This should give you an output like this; C:\WINDOWS\system32\cmd.exe LAPTOP\IUSR_LAPTOP:N BUILTIN\Users:R BUILTIN\Power Users:R BUILTIN\Administrators:F NT AUTHORITY\SYSTEM:F Here you'll see that the anonymous IIS user account (IUSR_LAPTOP) has no permissions at all to cmd.exe. Next lets create a simple PHP script to test the exec function. Enter the following into a file called exec.php (or similar, as long as it has the PHP extension); <?php echo exec('cmd /c echo Hello World!');?> Once you've done that, save the file into your webroot and then access it via your Internet browser. Providing you have the display_error directive in php.ini set to on it should return the following error; Warning: exec() [function.exec]: Unable to fork [cmd /c echo Hello World!] in C:\Inetpub\wwwroot\exec.php on line 2 Now lets head back to the command prompt to modify the ACL on cmd.exe. To do this type the following into the command prompt; cacls %COMSPEC% /E /G %COMPUTERNAME%\IUSR_%COMPUTERNAME%:R What this command does is alter the existing ACL to grant the read permission to the cmd.exe executable to the anonymous IIS user account. We can verify this now by running the very first command in this article again which should now return this; C:\WINDOWS\system32\cmd.exe LAPTOP\IUSR_LAPTOP:R BUILTIN\Administrators:F BUILTIN\Power Users:R AUTHORITY\SYSTEM:F NT BUILTIN\Users:R You should now be able to run the PHP test script from above again, but this time instead of an error you should be greeted with a "Hello World!" message.

3 Page 3 of 6 Page 3 of 6 If you find that the script you are using is trying to access a file other than cmd.exe, then it should be a simple matter of substitution. One word of warning though which is that by modifying the ACL in this way is loosening the security on your system which could potentially be abused. If you have any comments or questions please feel free to post them here or in the forums. Bookmark/Search this post with: Average rating Rate this: (1 vote)» Add new comment 4621 reads Comments This didn't help Submitted by Anonymous on Thu, :21. I am using a different user for the application and granted this user permission to use cmd.exe, but still get Unable to fork. Ads by Google Without knowing anything Submitted by Brashquido on Thu, :54. Without knowing anything about the account you have setup I'm not going to be a great deal of help. I'd start by checking things like group memberships and your local security policy and compare that to the IIS user account. 3 x Microsoft IIS MVP, MCSE, MCSA very good Tip Submitted by Anonymous on Thu, :11. I solved problem...! Glad I could Submitted by Brashquido on Wed, :50.

4 Page 4 of 6 Page 4 of 6 Glad I could help! 3 x Microsoft IIS MVP, MCSE, MCSA substitute cmd.exe with cacls.exe Submitted by Constance.Kan on Wed, :56. cmd.exe does work as suggested above..but when I substitute it with cacls.exe and grant cacls.exe/iuser the same permission as cmd.exe, it doesn't work. Below is the php code... $filepath = "c:\ppan"; $username = "ppan"; $cmd = "c:\windows\system32\cacls.exe ".$filepath." /e /g ".$username.":f"; echo $cmd; $result = exec($cmd); echo $result; I want to run above to grant ppan the full control right to his own directory. But when I copy the command "c:\windows\system32\cacls.exe c:\ppan /e /g ppan:f", it works at perfectly in the command prompt. Can you help please? NOTE: I'm using IIS!! I don't have my test Submitted by Brashquido on Wed, :54. I don't have my test environment available at the moment, but you could try specifying cmd.exe to execute you cacls command by doing something like this; $filepath = "c:\ppan"; $username = "ppan"; $cacls = "c:\windows\system32\cacls.exe"; $cmd = "c:\windows\system32\cmd.exe /c ".$cacls." /e /g ".$filepath." ".$username.":f"; echo $cmd; $result = exec($cmd); echo $result; 4 x Microsoft IIS MVP, MCSE, MCSA Still No Joy With exec()

5 Page 5 of 6 Page 5 of 6 Submitted by Anonymous on Wed, :49. I still cannot get an exec() call to work. The access permissions on the individual file I am trying to execute (GNU diff.exe) allow the IUSR_%COMPUTERNAME% account full control. I also set the IIS execute permissions on the virtual directory to Scripts & Executables. But still no joy. Anything else I should look for? Thanks! Michael M. What happens if you try and Submitted by Brashquido on Wed, :59. What happens if you try and run the sample script detailed in the article? 4 x Microsoft IIS MVP, MCSE, MCSA PHP and Permissions Submitted by Anonymous on Wed, :02. Hi Dominic, Great article and nice website. We are currently testing on a local Windows 2003 Box PHP 5.2 and permissions. It seems even with the basic isapi install that you can upload what people call a PHP WebShell and execute almost any command. Is giving access the the cmd.exe just another way to allow these commands to be executed? I've been searching for a solution for this and cannot seem to find out how to install PHP on Windows and not have PHPWebshells be able to run. The default permissions are Submitted by Brashquido on Fri, :12. The default permissions are not as tight as they could be, however they should be enough in most cases. In short I do NOT recommend giving PHP access to execute cmd.exe for the very reasons you mention, however there are legitmate PHP scripts however that require this to function fully. Apart from battening down NTFS permissions, have a browse through your php.ini file and you'll see there are several directives that allow you to restrict the path that PHP scripts can be executed from and also the ability to disbable potentially dangerous functions. 4 x Microsoft IIS MVP, MCSE, MCSA Latest Recent Content Comments Popular Content

6 Page 6 of 6 Page 6 of 6 p Worked REQUEST_URI like a champ. fix for FastCGI on IIS 7 16 hours 40 min ago Using Drupal with Microsoft URL Rewrite Module for IIS 7 The default permissions are Using ISAPI Rewrite 3 with Gallery 2 5 days 19 hours ago Getting Started Question... Thanks for letting me know IIS 5 days PHP 19 Configuration hours ago IIS PHP Aid and migrated Permissions to dedicated server 1 week 1 day ago Installing PHP 5 on IIS in 5 simple steps Setting About Us up your Contact own Us server Site Map with (c) hmailserver 2008 IIS Aid PTY LTD. Are Hotmail cutting their own throat Install and configure phpmyadmin on IIS Difference between PHP thread safe and non thread safe binaries Using Drupal Clean URLs with IIS and ISAPI Rewrite