PHPShell default user www-data, how to change?

[l11h]

Hi,

 

So i'm using PHPShell as a terminal system to access my server through the web browser for a project. For some reason the default user is www-data and I can't seem to change it. Some other tutorial I followed did same thing as I did however, his user was the user he logged in with not www-data. So anyone know how to do this? 

 

The reason i'm using this is because I want to do parsing. Meaning if a user enters a command like rm -rf *, it checks it with the database blacklist and blocks it. This is doable as the input field is a text box. 

 

Other options available use JavaScript so this is not available  

 

Anyway if this can be fixed I will appreciate your help a lot.

 

Thanks

[xXxYOLOxSWAGxXx_420BlazeIt]

Change the owner of the executable.

[l11h]

Change the owner of the executable.

 

Problem is the owner of the file phpshell.php is actually the normal user being testuser in this case. 

 

or is ownership something different? which to change it's chown i guess.

 

However, when I log into the system and run whoami it says www-data .... that's the reason why i'm confused lol.

 

if executing is different what command to I use to change it? All I see is chown commands

[rashdanml]

Switch user, perhaps?

 

su tempuser

[l11h]

 

Switch user, perhaps?

su tempuser

Tried that and that doesn't seem to work. 

 

I think what this PHP Shell is doing is, it's a text box, it's using php_exec to send the command to the server and then just writes the output.

 

doing su all it says is it's not a terminal and tty is not present. 

 

I know there are stuff like Gate One and Shellinabox which use Javascript and work exactly like a terminal does if your sitting in front of it. However, what I want is a text box where I can check the commands before sending them. 

Is there any technology that I can research that will do this? 

With the Javascript I know there are ways of saying this command is not good however, it can be bypassed using a javascript command line.

[rashdanml]

Could be a security risk, but give these suggestions a try:

http://stackoverflow.com/questions/7181601/using-shell-exec-or-exec-as-a-different-unix-user

 

It also should be possible to run apache as testuser instead of www-data. The above link gives one method to do so, not sure if it's something you'll be able to do though.