PHP LiveAPI API Privilege Escalation / how to call

TheMrg

• November 29, 2017 12:02

Hi, question about privilege escalation from PHP LiveAPI: i addes namespace and modul in /usr/local/cpanel/bin/admin/Test (with test and test.conf) added paper_lantern/test/test.live.php and test.live.pl with perl i can call $val = Cpanel::AdminBin::Call::call( 'Test', 'test', "callfkt", "argum", ); succesfully But how to call it from PHP LiveAPI? $data=$cpanel->api2('Test', 'test', array('modul'=>'callfkt','args'=>'argum')); This is or little different isnot working. sure. This means call Test.pm to Cpanel Is there a api2 or uapi call to the "Cpanel::AdminBin::Call::call" ? Or other method to call my root / priv. esc. Script? Explain: This is because my plugin needs PHP. So paper_lantern/test/test.live.php is needed (no perl). Thanks.

• 

  cPanelMichael

  • November 29, 2017 18:21

  Hello, Here's a response from one of our Technical Analyst's answering a similiar question in a support ticket (it was for a different purpose, but appears to apply to your question as well): After reviewing this and discussing your request with a developer, I am afraid that I don't believe we will be able to provide you specifically what you are looking for. By intentional design our privilege escalation system makes running PHP as root impossible. Rather what is suggested is that you first create a custom UAPI function: Unfortunately this has to be done in Perl. Your LiveAPI script will call this custom UAPI module. The custom UAPI module will in turn call the custom adminbin located in /usr/local/cpanel/bin/admin//: Guide to API Privilege Escalation - Software Development Kit - cPanel Documentation You custom adminbin script would in turn call the Whostmgr::API::1::IPv6::ipv6_enable_account function. The developer I spoke to said this last part does require some documentation, but I am afraid that this would not be able to be written in PHP, so a PHP example would not be forthcoming
  Thank you.

  0
• 

  TheMrg

  • November 30, 2017 09:47

  Thanks, but how can we run a PHP Script as Root with this succestion?

  0
• 

  cPanelMichael

  • November 30, 2017 19:57

  Hello, My understanding is that using PHP for that purpose isn't supported. Feel free to send an email to integration@cpanel.net[/EMAIL] if you'd like some additional feedback to this question from one of our Developers. Thank you.

  0

Please sign in to leave a comment.