Trying to make my point, that running Apache with PHP5 module as Windows service is not secure.
All I got to prove it - FTP access to some internal website. So what I did - I uploaded file test.php with content:
<?php system('whoami'); // output: nt authority\system file_put_contents('C:\test.txt', 'this server is hacked'); echo file_get_contents('C:\test.txt'); // output: this server is hacked system('ping 127.0.0.1'); // Ping output: 4 packets sent, 4 received system('net stop apache2.2'); // No Output system('shutdown /r /f /t 1'); // No Output ?>
Then I hit browser at:
All commands executed, except shutdown and net stop.
Windows, Apache and PHP configurations are default.
Is it true that running Windows+Apache+PHP out of box, safe enough from executing major system commands like shutdown?