Unable to execute curl command from php script?

Question

I tried to create a PHP script which will be invoked when someone click on a button and will be taken to vt.php now I want to download the sample based on the VT hash which is received from previous PHP page now I tried using this logic but it is not working.

<?php


$fileHash = $_POST['hash'];

echo $fileHash;
#$command = escapeshellcmd("python vt_download.py $fileHash");
$command = escapeshellcmd("curl -v --location https://www.virustotal.com/vtapi/v2/file/download?apikey=APIKEY\&hash=$fileHash -o $fileHash");
$output = shell_exec($command);
echo $output;

?>

Output c75b5e2ca63adb462f4bb941e0c9f509

Expected output c75b5e2ca63adb462f4bb941e0c9f509 File Downloding Process ------- curl output

When this page is called it is only printing the hash and not downloading the file.Any suggestions to solve this?

P.S : Error in downloading file from VirusTotal only on server? -- Previously asked this question here,either this or that using python will help.

No need to use shell_exec, it's an open door for security leaks, especially in your case where you're providing user inputed data. cUrl exists as a PHP library too : php.net/manual/en/book.curl.php — Sir McPotato
– Sir McPotato, Commented Feb 27, 2017 at 16:12
You're using escaeshellcmd but you also seem to have done some manual escaping. It should be one or the other. — apokryfos
– apokryfos, Commented Feb 27, 2017 at 16:14
@SirMcPotato <?php #$fileHash = $_POST['hash']; $fileHash = 'c75b5e2ca63adb462f4bb941e0c9f509'; #echo $5e2ca63adb462f4bb941e0c9f509i9 curl_setopt($ch , CURLOPT_URL , "https://www.virustotal.com/vtapi/v2/file/download?apikey=APIKEY\&hash=$fileHash -o $fileHash"); curl_exec($ch); curl_close($ch); ?> Is it Correct? — SaiKiran
– SaiKiran, Commented Feb 27, 2017 at 18:33

Akmal Irfan · Accepted Answer · 2023-09-21 15:51:17Z

1

You can directly use PHP cURL library instead of using the shell_exec function that can quickly lead to security issues when using user-inputed data.

<?php
    $fileHash = $_POST['hash'];

    // Initializing cURL, we can put the URL in the curl_init function
    $ch = curl_init("https://www.virustotal.com/vtapi/v2/file/download?apikey=AP‌IKEY&hash=$fileHash");

    // We need to retrieve the response, setting appropriate options :
    curl_setopt($ch , CURLOPT_RETURNTRANSFER , true);

    // Executing the request
    $result = curl_exec($ch);

    // Error verification
    if (!$result){
        echo('Error: "' . curl_error($ch) . '" - Code: ' . curl_errno($ch));
    }
    curl_close($ch);
?>

edited Sep 21, 2023 at 15:51

Akmal Irfan

2532 silver badges7 bronze badges

answered Feb 28, 2017 at 8:17

Sir McPotato

9897 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Unable to execute curl command from php script?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related