!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/bin/   drwxr-xr-x
Free 52.24 GB of 127.8 GB (40.87%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     c2ph (35.74 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
#!/usr/bin/perl
    eval 'exec /usr/bin/perl -S $0 ${1+"$@"}'
	if $running_under_some_shell;
#
#
#   c2ph (aka pstruct)
#   Tom Christiansen, 
#
#   As pstruct, dump C structures as generated from 'cc -g -S' stabs.
#   As c2ph, do this PLUS generate perl code for getting at the structures.
#
#   See the usage message for more.  If this isn't enough, read the code.
#

=head1 NAME

c2ph, pstruct - Dump C structures as generated from C stabs

=head1 SYNOPSIS

    c2ph [-dpnP] [var=val] [files ...]

=head2 OPTIONS

    Options:

    -w	wide; short for: type_width=45 member_width=35 offset_width=8
    -x	hex; short for:  offset_fmt=x offset_width=08 size_fmt=x size_width=04

    -n	do not generate perl code  (default when invoked as pstruct)
    -p	generate perl code         (default when invoked as c2ph)
    -v	generate perl code, with C decls as comments

    -i	do NOT recompute sizes for intrinsic datatypes
    -a	dump information on intrinsics also

    -t	trace execution
    -d	spew reams of debugging output

    -slist  give comma-separated list a structures to dump

=head1 DESCRIPTION

The following is the old c2ph.doc documentation by Tom Christiansen

Date: 25 Jul 91 08:10:21 GMT

Once upon a time, I wrote a program called pstruct.  It was a perl
program that tried to parse out C structures and display their member
offsets for you.  This was especially useful for people looking at
binary dumps or poking around the kernel.

Pstruct was not a pretty program.  Neither was it particularly robust.
The problem, you see, was that the C compiler was much better at parsing
C than I could ever hope to be.

So I got smart:  I decided to be lazy and let the C compiler parse the C,
which would spit out debugger stabs for me to read.  These were much
easier to parse.  It's still not a pretty program, but at least it's more
robust.

Pstruct takes any .c or .h files, or preferably .s ones, since that's
the format it is going to massage them into anyway, and spits out
listings like this:

 struct tty {
   int                          tty.t_locker                         000      4
   int                          tty.t_mutex_index                    004      4
   struct tty *                 tty.t_tp_virt                        008      4
   struct clist                 tty.t_rawq                           00c     20
     int                        tty.t_rawq.c_cc                      00c      4
     int                        tty.t_rawq.c_cmax                    010      4
     int                        tty.t_rawq.c_cfx                     014      4
     int                        tty.t_rawq.c_clx                     018      4
     struct tty *               tty.t_rawq.c_tp_cpu                  01c      4
     struct tty *               tty.t_rawq.c_tp_iop                  020      4
     unsigned char *            tty.t_rawq.c_buf_cpu                 024      4
     unsigned char *            tty.t_rawq.c_buf_iop                 028      4
   struct clist                 tty.t_canq                           02c     20
     int                        tty.t_canq.c_cc                      02c      4
     int                        tty.t_canq.c_cmax                    030      4
     int                        tty.t_canq.c_cfx                     034      4
     int                        tty.t_canq.c_clx                     038      4
     struct tty *               tty.t_canq.c_tp_cpu                  03c      4
     struct tty *               tty.t_canq.c_tp_iop                  040      4
     unsigned char *            tty.t_canq.c_buf_cpu                 044      4
     unsigned char *            tty.t_canq.c_buf_iop                 048      4
   struct clist                 tty.t_outq                           04c     20
     int                        tty.t_outq.c_cc                      04c      4
     int                        tty.t_outq.c_cmax                    050      4
     int                        tty.t_outq.c_cfx                     054      4
     int                        tty.t_outq.c_clx                     058      4
     struct tty *               tty.t_outq.c_tp_cpu                  05c      4
     struct tty *               tty.t_outq.c_tp_iop                  060      4
     unsigned char *            tty.t_outq.c_buf_cpu                 064      4
     unsigned char *            tty.t_outq.c_buf_iop                 068      4
   (*int)()                     tty.t_oproc_cpu                      06c      4
   (*int)()                     tty.t_oproc_iop                      070      4
   (*int)()                     tty.t_stopproc_cpu                   074      4
   (*int)()                     tty.t_stopproc_iop                   078      4
   struct thread *              tty.t_rsel                           07c      4

etc.


Actually, this was generated by a particular set of options.  You can control
the formatting of each column, whether you prefer wide or fat, hex or decimal,
leading zeroes or whatever.

All you need to be able to use this is a C compiler than generates
BSD/GCC-style stabs.  The B<-g> option on native BSD compilers and GCC
should get this for you.

To learn more, just type a bogus option, like B<-\?>, and a long usage message
will be provided.  There are a fair number of possibilities.

If you're only a C programmer, than this is the end of the message for you.
You can quit right now, and if you care to, save off the source and run it
when you feel like it.  Or not.



But if you're a perl programmer, then for you I have something much more
wondrous than just a structure offset printer.

You see, if you call pstruct by its other incybernation, c2ph, you have a code
generator that translates C code into perl code!  Well, structure and union
declarations at least, but that's quite a bit.

Prior to this point, anyone programming in perl who wanted to interact
with C programs, like the kernel, was forced to guess the layouts of
the C structures, and then hardwire these into his program.  Of course,
when you took your wonderfully crafted program to a system where the
sgtty structure was laid out differently, your program broke.  Which is
a shame.

We've had Larry's h2ph translator, which helped, but that only works on
cpp symbols, not real C, which was also very much needed.  What I offer
you is a symbolic way of getting at all the C structures.  I've couched
them in terms of packages and functions.  Consider the following program:

    #!/usr/local/bin/perl

    require 'syscall.ph';
    require 'sys/time.ph';
    require 'sys/resource.ph';

    $ru = "\0" x &rusage'sizeof();

    syscall(&SYS_getrusage, &RUSAGE_SELF, $ru)      && die "getrusage: $!";

    @ru = unpack($t = &rusage'typedef(), $ru);

    $utime =  $ru[ &rusage'ru_utime + &timeval'tv_sec  ]
	   + ($ru[ &rusage'ru_utime + &timeval'tv_usec ]) / 1e6;

    $stime =  $ru[ &rusage'ru_stime + &timeval'tv_sec  ]
	   + ($ru[ &rusage'ru_stime + &timeval'tv_usec ]) / 1e6;

    printf "you have used %8.3fs+%8.3fu seconds.\n", $utime, $stime;


As you see, the name of the package is the name of the structure.  Regular
fields are just their own names.  Plus the following accessor functions are
provided for your convenience:

    struct	This takes no arguments, and is merely the number of first-level
		elements in the structure.  You would use this for indexing
		into arrays of structures, perhaps like this


		    $usec = $u[ &user'u_utimer
				+ (&ITIMER_VIRTUAL * &itimerval'struct)
				+ &itimerval'it_value
				+ &timeval'tv_usec
			      ];

    sizeof   	Returns the bytes in the structure, or the member if
	     	you pass it an argument, such as

			&rusage'sizeof(&rusage'ru_utime)

    typedef  	This is the perl format definition for passing to pack and
	     	unpack.  If you ask for the typedef of a nothing, you get
	     	the whole structure, otherwise you get that of the member
	     	you ask for.  Padding is taken care of, as is the magic to
	     	guarantee that a union is unpacked into all its aliases.
	     	Bitfields are not quite yet supported however.

    offsetof	This function is the byte offset into the array of that
		member.  You may wish to use this for indexing directly
		into the packed structure with vec() if you're too lazy
		to unpack it.

    typeof	Not to be confused with the typedef accessor function, this
		one returns the C type of that field.  This would allow
		you to print out a nice structured pretty print of some
		structure without knoning anything about it beforehand.
		No args to this one is a noop.  Someday I'll post such
		a thing to dump out your u structure for you.


The way I see this being used is like basically this:

	% h2ph   /usr/lib/perl/tmp.ph
	% c2ph  some_include_file.h  >> /usr/lib/perl/tmp.ph
	% install

It's a little tricker with c2ph because you have to get the includes right.
I can't know this for your system, but it's not usually too terribly difficult.

The code isn't pretty as I mentioned  -- I never thought it would be a 1000-
line program when I started, or I might not have begun. :-)  But I would have
been less cavalier in how the parts of the program communicated with each
other, etc.  It might also have helped if I didn't have to divine the makeup
of the stabs on the fly, and then account for micro differences between my
compiler and gcc.

Anyway, here it is.  Should run on perl v4 or greater.  Maybe less.


 --tom

=cut

$RCSID = '$Id: c2ph,v 1.7 95/10/28 10:41:47 tchrist Exp Locker: tchrist $';

use File::Temp;

######################################################################

# some handy data definitions.   many of these can be reset later.

$bitorder = 'b';  # ascending; set to B for descending bit fields

%intrinsics =
%template = (
    'char', 			'c',
    'unsigned char', 		'C',
    'short',			's',
    'short int',		's',
    'unsigned short',		'S',
    'unsigned short int',	'S',
    'short unsigned int',	'S',
    'int',			'i',
    'unsigned int',		'I',
    'long',			'l',
    'long int',			'l',
    'unsigned long',		'L',
    'unsigned long',		'L',
    'long unsigned int',	'L',
    'unsigned long int',	'L',
    'long long',		'q',
    'long long int',		'q',
    'unsigned long long',	'Q',
    'unsigned long long int',	'Q',
    'float',			'f',
    'double',			'd',
    'pointer',			'p',
    'null',			'x',
    'neganull',			'X',
    'bit',			$bitorder,
);

&buildscrunchlist;
delete $intrinsics{'neganull'};
delete $intrinsics{'bit'};
delete $intrinsics{'null'};

# use -s to recompute sizes
%sizeof = (
    'char', 			'1',
    'unsigned char', 		'1',
    'short',			'2',
    'short int',		'2',
    'unsigned short',		'2',
    'unsigned short int',	'2',
    'short unsigned int',	'2',
    'int',			'4',
    'unsigned int',		'4',
    'long',			'4',
    'long int',			'4',
    'unsigned long',		'4',
    'unsigned long int',	'4',
    'long unsigned int',	'4',
    'long long',		'8',
    'long long int',		'8',
    'unsigned long long',	'8',
    'unsigned long long int',	'8',
    'float',			'4',
    'double',			'8',
    'pointer',			'4',
);

($type_width, $member_width, $offset_width, $size_width) = (20, 20, 6, 5);

($offset_fmt, $size_fmt) = ('d', 'd');

$indent = 2;

$CC = 'cc';
$CFLAGS = '-gstabs -S';
$DEFINES = '';

$perl++ if $0 =~ m#/?c2ph$#;

require 'getopts.pl';

use File::Temp 'tempdir';

eval '$'.$1.'$2;' while $ARGV[0] =~ /^([A-Za-z_]+=)(.*)/ && shift;

&Getopts('aixdpvtnws:') 
bool(false)

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0054 ]--