Running the p0f tool from PHP

james_cwy

I have tried using some of the codes that I know of but still I cannot get it to run.
I have a script located at
/root/UMThesis/p0f2003/p0f:
#!/bin/sh
#

p0f startup script. p0f is a passive fingerprinting tool

PURPOSE: To start the p0f process

Add '-d' to command line for debug information

set -x

Start p0f

./p0f > test.txt

When I run this shell script at the prompt, it will capture whatever data and pass it to test.txt.
And when I run the system monitor, I can see that p0f is running and when I check the /root/UMThesis/p0f2003/p0f, I see test.txt.

My question: Can I actually do the same thing through PHP? Meaning-I can actually run this program from a PHP page and p0f will run and show up in the network monitor and test.txt will be created?
I have tried exec and system but to no avail.
My main purpose here is instead of running p0f on the prompt I can run it using/through a webpage and then view the test.txt through a web page.
If this is possible, pls give an example on how to do it.
Thanks a million.Appreciate your help.

dalecosp

Hmm, I know little about p0f.

I did download and install it on a local box after reading your posts.

The tool needs elevated privileges in order to open the packet filtering device (at least it does on *BSD) and this will likely be one of your first concerns in getting this to work.

Apache+mod_php isn't going to cut it. Possibly PHP CGI suexec()'d ??

james_cwy

I am new at this.
What do you mean by PHP CGI?
How do I use it?
What do I need to do?

Pls advise

Thanks

dalecosp

There are two ways to run PHP in tandem with a webserver. One is Apache+mod_php, in which the PHP binary is compiled as a .so (shared object) and is loaded into the webserver by Apache. I dunno if other webservers use this model or not. Apache is so popular, I've no experience and haven't even read much about the others (including almost anything Windozeish, IIS, etc.)

The other way is by locating the PHP executable in the webserver's cgi-bin directory, and running all your scripts (?from) there. This is also something I've never done, but I'm thinking that you'd have to do this and run PHP with "root" privileges in order to allow the web page access to p0f.

Probably makes it about as clear as mud. We need some guru type advice ... or maybe a few hours with Google®

james_cwy

I have tried all the possible methods, exec, shell_exec, system,, etc.. but still I cannot get p0f to run.
After doing some searching and reading I found out about the cron daemon. Now I am not sure whether it will help.
How do I use this daemon to run the script that I mentioned in this first post? Can it be done?
Hope someone can give me a guide/example on what to do, how to do it,what do I add/configure/code,..etc.. and all the necessary info that I need to get my script to run p0f automatically.
I am really new at this.🙂
Thanks a million.Appreciate it

dalecosp

Probably a topic for the "unix" forum here, but we'll try. Type

#crontab -e

at the shell prompt to edit your crontab file.

Here's an example crontab file.

#min    hour    day     mon     weekday         command
*/5     *       *       *       *               /usr/local/bin/php -q /home/me/scr/todo.php > /dev/null 2>&1
30    4     *     *     *    /bin/cp /etc/backup.tar /var/backups/

0      0       1         1   *    /bin/echo "happy new year!"
@reboot                                 /usr/local/sbin/ndc start

The cron daemon wakes up every minute and checks if there's any work to do.

In this file, cron will, every five minutes, use the php CLI program (located at /usr/local/bin/php) in "quiet" mode (-q) to execute a php script (re: my todo list) which is in my "scr" subdir in my /home/ directory. Both stdout and stderr and being directed to the bit-bucket; otherwise, cron will mail me any results from running my commands.

At 4:30 a.m., cron will copy "backup.tar" from /etc/ to /var/backups/. And, in this case, if anything goes wrong, I'll get a mail. AFAIK, /bin/cp doesn't return anything if successful.

At midnight on New Year's Eve (I think?) the box will probably mail me the text you see for /bin/echo ... 😃

Finally, each time the box is rebooted, cron will restart the BIND daemon, and will send me mail about it.

HTH,

james_cwy

I am going to put all the shell scripts into root/bin/ folder that I had created and this bin folder's permission is 755.
The script here is:
#!/bin/sh
#

p0f startup script.

PURPOSE: To start the p0f process

Add '-d' to command line for debug information

set -x

Start p0f

/root/UMThesis/p0f2003/p0f/p0f >

/root/UMThesis/output.txt

location-/root/UMThesis/p0f2003/p0f/p0f
saved to -/root/UMThesis/output.txt

Permission for /root/UMThesis - 757 allowing others to write.
Permission for other folders in /root/UMThesis-755

I am using this to run p0f:
$stat=system('/bin/sh /root/bin/start-p0f.sh', $ret);
//will use /bin/sh to execute the script
echo $ret; //echoes return status of command (on 'Nix, 0 for success)
echo $stat; // echoes output of 'start.sh', if any

Once I got a return value of 1 and then 127.
Which is the right one? What should I get?

Checking at /root/UMThesis, the output.txt file is created but there is no output. Normally, when I run the script from prompt, there is output straight away?

Anyone know what is wrong?Pls help. I have been trying this for days and I do not know what is wrong. What am I doing wrong?

Thanks

james_cwy

After doing lots of reading on different websites on how to execute scripts, I noticed one thing.
My shell script is different because it actually executes a program through it namely p0f. This can be done to any program say eg tcpdump.
When typed at the prompt-start-p0f.sh, this script will trigger p0f to run and redirect the output to a file

I have not come across shell scripts like mine that needs to be used. Most shell scripts contains linux/unix commands(ls,rm,etc..) and that works fine using system, shell_exec, exec, etc..

I have tried using ls and it works fine using the PHP given commands-system, shell_exec, exec, etc..

Now I have my doubts whether these functions can actually execute a script that executes a program such as p0f or even tcpdump.

Can someone enlighten me on this issue?
Is there another way to do what I would like to do?

I have tried all the ways that I can think of and yet I cannot resolve this issue still.

Please advise. Thank you so much.

I think we really need some experts view on this

james_cwy

I have been trying to run the p0f tool from PHP and until now I have not succeeded.

I really hope to get some help from you guys.
What I know is this:
1. For PHP running inside a Webserver:

When calling a process via
system("your_process &");
to make it running in background, note that this process is killed when the webserver is restarted.

Note: If you start a program using this function and want to leave it running in the background, you have to make sure that the output of that program is redirected to a file or some other output stream or else PHP will hang until the execution of the program ends.

The problem is that I really do not know how to start the coding for this.

Hope someone can help and guide me in this.
Million Thanks
James