Trying to make my point, that running Apache with PHP5 module as Windows service is not secure.
All I got to prove it - FTP access to some internal website. So what I did - I uploaded file test.php with content:
<?php
system('whoami'); // output: nt authority\system
file_put_contents('C:\test.txt', 'this server is hacked');
echo file_get_contents('C:\test.txt'); // output: this server is hacked
system('ping 127.0.0.1'); // Ping output: 4 packets sent, 4 received
system('net stop apache2.2'); // No Output
system('shutdown /r /f /t 1'); // No Output
?>
Then I hit browser at: http://10.0.0.254/test.php
All commands executed, except shutdown and net stop.
Windows, Apache and PHP configurations are default.
Is it true that running Windows+Apache+PHP out of box, safe enough from executing major system commands like shutdown?