Running Apache as system service on Windows 2003 R2 64-bit

Question

Trying to make my point, that running Apache with PHP5 module as Windows service is not secure.

All I got to prove it - FTP access to some internal website. So what I did - I uploaded file test.php with content:

<?php
  system('whoami'); // output: nt authority\system
  file_put_contents('C:\test.txt', 'this server is hacked');
  echo file_get_contents('C:\test.txt'); // output: this server is hacked
  system('ping 127.0.0.1'); // Ping output: 4 packets sent, 4 received
  system('net stop apache2.2'); // No Output
  system('shutdown /r /f /t 1'); // No Output
?>

Then I hit browser at: http://10.0.0.254/test.php

All commands executed, except shutdown and net stop.

Windows, Apache and PHP configurations are default.

Is it true that running Windows+Apache+PHP out of box, safe enough from executing major system commands like shutdown?

Answer 1

The best solution to this problem is to run PHP via IIS isolated worker which is handled with fastcgi module.

If you want Apache, in Windows, you can create new local user, and dont put him into any groups, and on NTFS you can add permission to read the php files in docroot, as well everything else httpd is using like php and config files.

To run apache from any other user, you can change it in "services", or use "runas" command line.

You can also try to use existing groups, like "users", so the php wont be able to write to c:\, but it will be able to start apps, but not on the user console, but it's own (it's redirected if it's started as service).

Answer 2

That the PHP engine runs as a user with some extensive privileges is not "insecure" by itself. It depends on the context. If some attacker can induce your Apache/PHP to run arbitrary commands of his own, then you already are in rather deep trouble: this is sufficient to access whatever data the site code uses, to alter the site so as to fool other site users, or to serve as relay for another attack on some other sites. Giving the attacker some more extensive access to the local machine adds insult to injury, but this is not the biggest issue in such a situation.

Running Apache/PHP as a less-privileged user is a good idea, of course -- but believing that this would achieve security is not. It is merely damage containment. It just prevents an attacker who has already taken over your site, to take over the physical machine as well (or, at least, to take it over too easily -- local privilege escalation holes are rather common anyway).