!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/lib/python2.4/site-packages/sos/   drwxr-xr-x
Free 35.26 GB of 127.8 GB (27.59%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     policyredhat.py (7.21 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
## policy-redhat.py
## Implement policies required for the sos system support tool

## Copyright (C) Steve Conklin <sconklin@redhat.com>

### This program is free software; you can redistribute it and/or modify
## it under the terms of the GNU General Public License as published by
## the Free Software Foundation; either version 2 of the License, or
## (at your option) any later version.

## This program is distributed in the hope that it will be useful,
## but WITHOUT ANY WARRANTY; without even the implied warranty of
## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
## GNU General Public License for more details.

## You should have received a copy of the GNU General Public License
## along with this program; if not, write to the Free Software
## Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

import os
import commands
import sys
import string
from tempfile import gettempdir
from sos.helpers import *
import random
import re
import md5

SOME_PATH = "/tmp/SomePath"

#class SosError(Exception):
#    def __init__(self, code, message):
#        self.code = code
#        self.message = message
#
#    def __str__(self):
#        return 'Sos Error %s: %s' % (self.code, self.message)


class SosPolicy:
    "This class implements various policies for sos"
    def __init__(self):
        self.reportName = ""
        self.ticketNumber = ""

    def setCommons(self, commons):
        self.cInfo = commons
        return

    def validatePlugin(self, pluginpath):
        "Validates the plugin as being acceptable to run"
        # return value
        # TODO implement this
        #print "validating %s" % pluginpath
        return True

    def pkgRequires(self, name):
        # FIXME: we're relying on rpm to sort the output list
        cmd = "/bin/rpm -q --requires %s" % (name)
        return [requires[:-1].split() for requires in os.popen(cmd).readlines()]

    def allPkgsByName(self, name):
        # FIXME: we're relying on rpm to sort the output list
        cmd = "/bin/rpm --qf '%%{N} %%{V} %%{R} %%{ARCH}\n' -q %s" % (name,)
        pkgs = os.popen(cmd).readlines()
        return [pkg[:-1].split() for pkg in pkgs if pkg.startswith(name)]

    def pkgByName(self, name):
        # TODO: do a full NEVRA compare and return newest version, best arch
        try:
            # lame attempt at locating newest
            pkg = self.allPkgsByName(name)[-1]
        except IndexError:
            pkg = None

        return pkg

    def pkgDictByName(self, name):
        # FIXME: what does this do again ??
        pkgName = self.pkgByName(name)
        print pkgName
        if pkgName and len(pkgName) > len(name):
           return pkgName[len(name)+1:].split("-")
        else:
           return None

    def runlevelByService(self, name):
        ret = []
        try:
           for tabs in commands.getoutput("LC_ALL=C /sbin/chkconfig --list %s" % name).split():
              try:
                 (runlevel, onoff) = tabs.split(":", 1)
              except ValueError:
                 pass
              else:
                 if onoff == "on":
                    ret.append(int(runlevel))
        except:
           pass
        return ret

    def runlevelDefault(self):
        try:
            reg=self.fileGrep(r"^id:(\d{1}):initdefault:", "/etc/inittab")
            for initlevel in reg:
                return initlevel
        except:
            return 3

    def kernelVersion(self):
        return commands.getoutput("/bin/uname -r").strip("\n")

    def isKernelSMP(self):
        if self.kernelVersion()[-3:]=="smp": return True
        else: return False

    def rhelVersion(self):
        try:
            pkgname = self.pkgByName("redhat-release")["version"]
            if pkgname[0] == "4":
                return 4
            elif pkgname in [ "5Server", "5Client" ]:
                return 5
        except:
            pass
        return False

    def getArch(self):
        return commands.getoutput("/bin/uname -m").strip()

    def pkgNVRA(self, pkg):
        fields = pkg.split("-")
        version, release, arch = fields[-3:]
        name = "-".join(fields[:-3])
        return (name, version, release, arch)

    def preWork(self):
        # this method will be called before the gathering begins

        localname = commands.getoutput("/bin/uname -n").split(".")[0]

        if not self.cInfo['cmdlineopts'].batch:
            try:
                self.reportName = raw_input(_("Please enter your first initial and last name [%s]: ") % localname)
                self.reportName = re.sub(r"[^a-zA-Z.0-9]", "", self.reportName)

                self.ticketNumber = raw_input(_("Please enter the case number that you are generating this report for: "))
                self.ticketNumber = re.sub(r"[^0-9]", "", self.ticketNumber)
                print
            except:
                print
                sys.exit(0)

        if len(self.reportName) == 0:
            self.reportName = localname
        
        if self.cInfo['cmdlineopts'].customerName:
            self.reportName = self.cInfo['cmdlineopts'].customerName        
            self.reportName = re.sub(r"[^a-zA-Z.0-9]", "", self.reportName)

        if self.cInfo['cmdlineopts'].ticketNumber:
            self.ticketNumber = self.cInfo['cmdlineopts'].ticketNumber
            self.ticketNumber = re.sub(r"[^0-9]", "", self.ticketNumber)

        return

    def packageResults(self):

        if len(self.ticketNumber):
            namestr = self.reportName + "." + self.ticketNumber
        else:
            namestr = self.reportName

        ourtempdir = gettempdir()
        tarballName = os.path.join(ourtempdir,  "sosreport-" + namestr + ".tar.bz2")

        namestr = namestr + "-" + str(random.randint(1, 999999))

        aliasdir = os.path.join(ourtempdir, namestr)

        tarcmd = "/bin/tar -jcf %s %s" % (tarballName, namestr)

        print _("Creating compressed archive...")
        if not os.access(string.split(tarcmd)[0], os.X_OK):
            print "Unable to create tarball"
            return

        # FIXME: gotta be a better way...
        os.system("/bin/mv %s %s" % (self.cInfo['dstroot'], aliasdir))
        curwd = os.getcwd()
        os.chdir(ourtempdir)
        oldmask = os.umask(077)
        # pylint: disable-msg = W0612
        status, shout, runtime = sosGetCommandOutput(tarcmd)
        os.umask(oldmask)
        os.chdir(curwd)
        # FIXME: use python internal command
        os.system("/bin/mv %s %s" % (aliasdir, self.cInfo['dstroot']))

        # add last 6 chars from md5sum to file name
        fp = open(tarballName, "r")
        md5out = md5.new(fp.read()).hexdigest()
        fp.close()
        oldtarballName = tarballName
        tarballName = os.path.join(ourtempdir, "sosreport-%s-%s.tar.bz2" % (namestr, md5out[-6:]) )
        os.system("/bin/mv %s %s" % (oldtarballName, tarballName) )
        # store md5 to a file
        fp = open(tarballName + ".md5", "w")
        fp.write(md5out + "\n")
        fp.close()

        sys.stdout.write("\n")
        print _("Your sosreport has been generated and saved in:\n  %s") % tarballName
        print
        if md5out:
            print _("The md5sum is: ") + md5out
            print
        print _("Please send this file to your support representative.")
        sys.stdout.write("\n")

        return


:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.013 ]--