!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/bin/   drwxr-xr-x
Free 52.29 GB of 127.8 GB (40.91%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     ps2epsi (1.94 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
#!/bin/sh # $Id: ps2epsi,v 1.7 2003/09/02 18:01:31 easysw Exp $ gs="`dirname $0`/gs" if test ! -x "$gs"; then gs=gs fi tmpfile=`mktemp ${TMPDIR-/tmp}/ps2epsi.XXXXXX` rm -f $tmpfile if test -e $tmpfile; then echo "$0: Our temporary file $tmpfile already exists." 1>&2 exit 1 fi trap "rm -rf $tmpfile" 0 1 2 3 7 13 15 export outfile if [ $# -lt 1 -o $# -gt 2 ]; then echo "Usage: `basename $0` file.ps [file.epsi]" 1>&2 exit 1 fi infile=$1; if [ $# -eq 1 ] then case "${infile}" in *.ps) base=`basename "${infile}" .ps` ;; *.cps) base=`basename "${infile}" .cps` ;; *.eps) base=`basename "${infile}" .eps` ;; *.epsf) base=`basename "${infile}" .epsf` ;; *) base=`basename "${infile}"` ;; esac outfile=${base}.epsi else outfile=$2 fi ls -l "${infile}" | awk 'F==1 { cd="%%CreationDate: " $6 " " $7 " " $8; t="%%Title: " $9; f="%%For:" U " " $3; c="%%Creator: Ghostscript ps2epsi from " $9; next; } /^%!/ {next;} /^%%Title:/ {t=$0; next;} /^%%Creator:/ {c=$0; next;} /^%%CreationDate:/ {cd=$0; next;} /^%%For:/ {f=$0; next;} !/^%/ { print "/ps2edict 30 dict def"; print "ps2edict begin"; print "/epsititle (" t "\\n) def"; print "/epsicreator (" c "\\n) def"; print "/epsicrdt (" cd "\\n) def"; print "/epsifor (" f "\\n) def"; print "end"; exit(0); } ' U="$USERNAME$LOGNAME" F=1 - F=2 "${infile}" >$tmpfile "$gs" -q -dNOPAUSE -dSAFER -dDELAYSAFER -r72 -sDEVICE=bit -sOutputFile=/dev/null $tmpfile ps2epsi.ps $tmpfile <"${infile}" 1>&2 rm -f $tmpfile ( cat << BEGINEPS save countdictstack mark newpath /showpage {} def /setpagedevice {pop} def %%EndProlog %%Page: 1 1 %%BeginDocument: ${infile} BEGINEPS cat "${infile}" | LC_ALL=C \ sed -e '/^%%BeginPreview:/,/^%%EndPreview[^!-\~]*$/d' -e '/^%!PS-Adobe/d' \ -e '/^%%[A-Za-z][A-Za-z]*[^!-\~]*$/d' -e '/^%%[A-Za-z][A-Za-z]*: /d' cat << ENDEPS %%EndDocument %%Trailer cleartomark countdictstack exch sub { end } repeat restore %%EOF ENDEPS ) >> "${outfile}" exit 0

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd
Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 
:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0057 ]--