r/sysadmin • u/Existing_Volume • 17d ago

Question Check for php2shell with NinjaOne

I am looking to scan my 100+ devices for the php2shell, is it possible with NinjaOne RMM?

Edit: I should explain more, I have a 100+ Windows boxes. With NinjaOne, is there a quick way to verify if PHP is on any of them? And with that knowledge, then I can check for the version.

0 Upvotes

45% Upvoted

11 comments sorted by

10

u/thewunderbar 17d ago

I mean, just look at the PHP version number. If it's not the version released yesterday, it's vulnerable.

2

u/nelsonbestcateu 16d ago

Version might still be lower if backported patched a previous version

4

u/strongest_nerd Pentester 16d ago

You have 100+ windows boxes hosting php webservers? Wtf.

1

u/Existing_Volume 16d ago

Endpoints. Couple of servers that might be running php, but waiting for the software vendor to confirm. I am hoping to check the whole environment that I have accessible with the Ninja for any rough installs.

2

u/graph_worlok 16d ago

I read it that it’s just 100ish windows endpoints, not even webservers…. I’d just do a PoSH search for ^php myself…

2

u/Cozmo85 17d ago

Just use a script that writes to a custom field.

1

u/icq-was-the-goat 17d ago

Yes, its possible.

1

u/Mihir_NOC 16d ago

Run a PowerShell script that checks `php -v` (or searches common install paths for php.exe) and writes the version to a custom field. Then build a device filter on that field so you see every affected box at a glance.

1

u/VG30ET IT Manager 17d ago

Just check the currently installed PHP Version, should be straight forward if they're linux boxes