Apache HTTP Server

Okay, break that down for me.

Let's think about how a web server like Apache operates.

It's software designed to take files from that specific HTML folder and serve them to anyone in the world who asks.

Right.

Because it interacts with the wild, untamed Internet, it's inherently vulnerable.

Therefore, the operating system isolates the web server, running it under a heavily restricted user account.

So if a hacker manages to compromise the web server software, if they break into Apache, they are stuck within that restricted user profile.

By default, even you, the human owner of the computer, do not have right access to that public facing directory without explicitly proving you're the administrator.

You can verify this behavior entirely from the server side.

Yeah, you log into your command server and tail the Apache access logs, usually located at slash var slash log slash Apache 2 slash.

Okay.

You will see the incoming GET request from your client appearing exactly every five seconds.

Those were just the deployment shut off to start the new deployment.

And then we changed the URL rewrite rule on the active, no, on the, Apache reverse proxy server to point to the new master node of the cluster.

So switching in between I-110 and I-70 is all controlled by the configuration of that reverse proxy server, what that URL rewrite was defined as.

So again, because we replaced the application servers, and kept the ActiveMQ and Apache Reverse Proxy servers as is.

That allowed for minimal changes to external interfaces like the Teamcenter and SAP interfaces because we did not change the IP address or host name of those servers.

And with the Reverse Proxy, The DNS that people were using to access, the URL that people were using to access the application did not change because DNS changes can take a while to propagate.

So this is instantaneous cutting over.

You change the URL rewrite and you restart Apache and you're cut over.

Because this was the beginning of cloud era, so we're starting to use AWS and these pre-configured routers and stuff.

But it was also at the end of the PHP Apache reign.

And that was a big part of the user-defined aspect, which is trying to make it easy for, really the goal was to get user code to run when certain events happen.

Just like, I mean, they're named after like SCM, like subversion hooks.

So the extensibility was a big part of it.

There were things that you just couldn't do with a REST API or polling.

But it was an ergonomics thing because, again, it was like the common stack people used was PHP and Apache.

So it was harder to set up a persistent process that would run or set up a cron job or whatever it is.

It listens for external requests, processes data, and serves content back across a network.

And to build this hosting environment, the blueprints introduce a classic trio, Apache, MySQL, and PHP.

The legendary LAMP stack.

Exactly.

If you're listening to this and you've spent any time around web infrastructure, you recognize this.

Linux, Apache, MySQL, PHP.

It's the backbone of so much of the web.

It really is.

And I think I misspoke there when I said protocol.

When a port is open, whatever's on the other side of that port, whether maybe it's RDP, but like you said, in this case, it's not RDP, you're popping the credentials and ultimately the endpoint, right? In the 443 example, it's Nginx or Apache, right? If there's a port available to one of those services, an attacker is going to try to find an exploit if they are persistent enough.

And that was my whole point.

Yes, and I think what stuns me is that people are arguing with you ever at any point.

often I hear that mentality or come across it.

I come across the occasional Reddit thread where someone's like, you know, like, well, you know...

It's probably fine because Apache has been around for, you know, 20 years or whatever it is.

20 years, I just pulled it off in there.

And we just used MSF Venom on Kali, delivering it to Windows Server and executing a powerful post-exploitation activity.

We covered everything that you have to know about attacking or configuring Apache web server to creating like a malicious executable and establishing like a remote control over the victim system.

And through Meterpreter, you performed various post exploitation tasks like you collected the system information using Sysinfo, Then you extracted the password hashes using hash dump.

And then you captured the screenshots highlighting how attackers can maintain persistent access and harvest sensitive data once the system is compromised.

Mm-hmm.

And I would install Apache on them.

Uh, and I'd do, like, the...

At my parents' house, I'd, uh, you know, I, I was the only one who bothered to configure the router, so I, uh, I set up all the port forwarding.