Getting access is denied for cmd command using php

Question

I am running PHP under IIS 6.

When I use any PHP function to run cmd commands (like exec() or system()), it always shows "Access is denied".

Even commands like ipconfig are showing same "access is denied" error. I have given all the permission to my project folder but it did not work.

Please let me know anyone the cause of it.

Answer 1

When you execute some command using exec, that command will be executed with the user account that is running IIS (which tipically is IUSR_«machine-name» on IIS 6), so your project's permissions don't have nothing to do with this.

What you need to do is to chance the permissions of the file C:\Windows\System32\cmd.exe and add permissions for IUSR_«machine-name».

Besides this, you'll probably need to use CACLS to change the access control list. Replace IUSR_MachineName on the following command for the user executing PHP and then execute this command:

CACLS c:\windows\system32\cmd.exe /E /G IUSR_MachineName:F

If you get an error and can't change the ACL, your last resource is to execute the following command first:

takeown /F c:\windows\system32\cmd.exe

You also might need to set the correct permissions and ACL for the commands you're trying to execute (for eg C:\Windows\System32\schtasks.exe)

Note: Do this with caution though. If you have some vulnerability that allows your users to execute commands, it can have nasty consequences.