Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Trying to make my point, that running Apache with PHP5 module as Windows service is not secure.

All I got to prove it - FTP access to some internal website. So what I did - I uploaded file test.php with content:

<?php
  system('whoami'); // output: nt authority\system
  file_put_contents('C:\test.txt', 'this server is hacked');
  echo file_get_contents('C:\test.txt'); // output: this server is hacked
  system('ping 127.0.0.1'); // Ping output: 4 packets sent, 4 received
  system('net stop apache2.2'); // No Output
  system('shutdown /r /f /t 1'); // No Output
?>

Then I hit browser at: http://10.0.0.254/test.php

All commands executed, except shutdown and net stop.

Windows, Apache and PHP configurations are default.

Is it true that running Windows+Apache+PHP out of box, safe enough from executing major system commands like shutdown?

share|improve this question
    
I'm not sure what the question is. –  Mark C. Wallace Oct 19 '12 at 11:37
1  
This is a known (reported) issue in Apache, reported as Bug 52162 ("Default Service Account"). –  user2036 Oct 19 '12 at 12:35
    
As Mark says - what is the question here? –  Rory Alsop Oct 19 '12 at 13:23
    
@All: Question in the last sentence followed by question mark. –  Radio Oct 19 '12 at 14:40
add comment

2 Answers

up vote 2 down vote accepted

The best solution to this problem is to run PHP via IIS isolated worker which is handled with fastcgi module.

If you want Apache, in Windows, you can create new local user, and dont put him into any groups, and on NTFS you can add permission to read the php files in docroot, as well everything else httpd is using like php and config files.

To run apache from any other user, you can change it in "services", or use "runas" command line.

You can also try to use existing groups, like "users", so the php wont be able to write to c:\, but it will be able to start apps, but not on the user console, but it's own (it's redirected if it's started as service).

share|improve this answer
    
Looks like creating new user and setting up permissions is the only way to secure it. –  Radio Oct 19 '12 at 2:41
add comment

That the PHP engine runs as a user with some extensive privileges is not "insecure" by itself. It depends on the context. If some attacker can induce your Apache/PHP to run arbitrary commands of his own, then you already are in rather deep trouble: this is sufficient to access whatever data the site code uses, to alter the site so as to fool other site users, or to serve as relay for another attack on some other sites. Giving the attacker some more extensive access to the local machine adds insult to injury, but this is not the biggest issue in such a situation.

Running Apache/PHP as a less-privileged user is a good idea, of course -- but believing that this would achieve security is not. It is merely damage containment. It just prevents an attacker who has already taken over your site, to take over the physical machine as well (or, at least, to take it over too easily -- local privilege escalation holes are rather common anyway).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.