Trying to make my point, that running Apache with PHP5 module as Windows service is not secure.

All I got to prove it - FTP access to some internal website. So what I did - I uploaded file test.php with content:

  system('whoami'); // output: nt authority\system
  file_put_contents('C:\test.txt', 'this server is hacked');
  echo file_get_contents('C:\test.txt'); // output: this server is hacked
  system('ping'); // Ping output: 4 packets sent, 4 received
  system('net stop apache2.2'); // No Output
  system('shutdown /r /f /t 1'); // No Output

Then I hit browser at:

All commands executed, except shutdown and net stop.

Windows, Apache and PHP configurations are default.

Is it true that running Windows+Apache+PHP out of box, safe enough from executing major system commands like shutdown?

  • I'm not sure what the question is.
    – MCW
    Oct 19, 2012 at 11:37
  • 1
    This is a known (reported) issue in Apache, reported as Bug 52162 ("Default Service Account").
    – user2036
    Oct 19, 2012 at 12:35
  • As Mark says - what is the question here?
    – Rory Alsop
    Oct 19, 2012 at 13:23
  • @All: Question in the last sentence followed by question mark.
    – Alex G
    Oct 19, 2012 at 14:40

2 Answers 2


The best solution to this problem is to run PHP via IIS isolated worker which is handled with fastcgi module.

If you want Apache, in Windows, you can create new local user, and dont put him into any groups, and on NTFS you can add permission to read the php files in docroot, as well everything else httpd is using like php and config files.

To run apache from any other user, you can change it in "services", or use "runas" command line.

You can also try to use existing groups, like "users", so the php wont be able to write to c:\, but it will be able to start apps, but not on the user console, but it's own (it's redirected if it's started as service).

  • Looks like creating new user and setting up permissions is the only way to secure it.
    – Alex G
    Oct 19, 2012 at 2:41

That the PHP engine runs as a user with some extensive privileges is not "insecure" by itself. It depends on the context. If some attacker can induce your Apache/PHP to run arbitrary commands of his own, then you already are in rather deep trouble: this is sufficient to access whatever data the site code uses, to alter the site so as to fool other site users, or to serve as relay for another attack on some other sites. Giving the attacker some more extensive access to the local machine adds insult to injury, but this is not the biggest issue in such a situation.

Running Apache/PHP as a less-privileged user is a good idea, of course -- but believing that this would achieve security is not. It is merely damage containment. It just prevents an attacker who has already taken over your site, to take over the physical machine as well (or, at least, to take it over too easily -- local privilege escalation holes are rather common anyway).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.