在PHP中正确转义SSH命令

时间:2012-12-03 01:15:56

标签: php shell ssh escaping libssh2

我有一个SSH命令,我想用PHP中的libssh2执行:

sh -c '
  rm -f /tmp/command.log
  sleep 3 &
  screen -p 0 -X stuff "\
script -a -c \"ls -l\" /tmp/command.log; kill -USR1 $!
"
  wait
  cat /tmp/command.log
'

我似乎无法正常逃脱它,所以SSH完全按照上面的方式接收它。我需要用双引号将它包装起来,这样我也可以在那里获得PHP变量(ls -l将成为$ command)。

我试过了:

"sh -c '
  rm -f /tmp/command.log
  sleep 3 &
  screen -p 0 -X stuff \"\
script -a -c \\"ls -l\\" /tmp/command.log; kill -USR1 $!
\"
  wait
  cat /tmp/command.log
'"

以及:

"sh -c '
  rm -f /tmp/command.log
  sleep 3 &
  screen -p 0 -X stuff \"\
script -a -c \\\"ls -l\\\" /tmp/command.log; kill -USR1 $!
\"
  wait
  cat /tmp/command.log
'"

第一个返回PHP错误,第二个错误不运行命令。

整个功能(在编辑摩根王尔德建议之后):

    function runShellCommand($command, $host, $user, $pass, $port){
        if (!function_exists("ssh2_connect")) die("Fail: function ssh2_connect doesn't exist");
        if(!($con = ssh2_connect($host, $port))){
            return "Unable to establish connection. Is your server offline?";
        } else {
            if(!ssh2_auth_password($con, $user, $pass)) {
                return "Failed to authenticate. Please ensure your server's password matches our records.";
            } else {
                $run = <<<HEREDOC
sh -c '
rm -f /tmp/command.log
sleep 3 &
screen -p 0 -X stuff "\
script -a -c \"touch /root/test234\" /tmp/command.log; kill -USR1 $!
"
wait
cat /tmp/command.log
'
HEREDOC;
                if (!($stream = ssh2_exec($con,  $run ))) {
                    return "Could not run command.";
                } else {
                    stream_set_blocking($stream, true);
                    $data = "";
                    while ($buf = fread($stream,4096)) {
                        $data .= $buf;
                    }
                    fclose($stream);
                    if(empty($data)){
                        return "sh-4.1# $command\n\n";
                    } else {
                        return "sh-4.1# $command\n$data\n";
                    }
                }
            }
        }
    }

2 个答案:

答案 0 :(得分:1)

如何使用HEREDOC字符串引用?我没有尝试过,但它适用于其他用例。

$command = <<<HEREDOC
sh -c '
rm -f /tmp/command.log
sleep 3 &
screen -p 0 -X stuff "\
script -a -c \"ls -l\" /tmp/command.log; kill -USR1 $!
"
wait
cat /tmp/command.log
'
HEREDOC;

此处有更多内容 - http://php.net/manual/en/language.types.string.php

答案 1 :(得分:0)

试试phpseclib, a pure PHP SSH implementation。例如

<?php
include('Net/SSH2.php');

$ssh = new Net_SSH2('www.domain.tld');
if (!$ssh->login('username', 'password')) {
    exit('Login Failed');
}

echo $ssh->read('username@username:~$');
$ssh->write("rm -f /tmp/command.log\n");
echo $ssh->read('username@username:~$');
$ssh->write("sleep 3 &\n");
echo $ssh->read('username@username:~$');
$ssh->write("screen -p 0 -X stuff \"\
script -a -c \\\"ls -l\\\" /tmp/command.log; kill -USR1 $!
\"");
...
?>