!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/libexec/webmin/bacula-backup/   drwxr-xr-x
Free 50.93 GB of 127.8 GB (39.85%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     poolstatus_form.cgi (1.96 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
#!/usr/bin/perl
# Show a form for displaying the status of one pool

require './bacula-backup-lib.pl';
&ui_print_header(undef,  $text{'poolstatus_title'}, "", "poolstatus");
&ReadParse();

# Show pool selector
$conf = &get_director_config();
@pools =  map { $n=&find_value("Name", $_->{'members'}) }
        &find("Pool", $conf);
@pools = sort { lc($a) cmp lc($b) } @pools;
if (@pools == 1) {
    $in{'pool'} ||= $pools[0];
    }
print &ui_form_start("poolstatus_form.cgi");
print "<b>$text{'poolstatus_show'}</b>\n";
print &ui_select("pool", $in{'pool'},
     [ map { [ $_ ] } @pools ]);
print &ui_submit($text{'poolstatus_ok'}),"<br>\n";
print &ui_form_end();

if ($in{'pool'}) {
    # Show volumes in this pool
    @volumes = &get_pool_volumes($in{'pool'});

    print &ui_subheading($text{'poolstatus_volumes'});
    $never = "<i>$text{'poolstatus_never'}</i>";
    if (@volumes) {
        print &ui_form_start("delete_volumes.cgi", "post");
        print &ui_hidden("pool", $in{'pool'}),"\n";
        print &select_all_link("d", 1),"\n";
        print &select_invert_link("d", 1),"<br>\n";
        @tds = ( "width=5" );
        print &ui_columns_start([ "",
                      $text{'poolstatus_name'},
                      $text{'poolstatus_type'},
                      $text{'poolstatus_first'},
                      $text{'poolstatus_last'},
                      $text{'poolstatus_bytes'},
                      $text{'poolstatus_status'} ],
                    "100%", 0, \@tds);
        foreach $v (@volumes) {
            print &ui_columns_row([
                &ui_checkbox("d", $v->{'volumename'}),
                $v->{'volumename'},
                $v->{'mediatype'},
                $v->{'firstwritten'} || $never,
                $v->{'lastwritten'} || $never,
                $v->{'volbytes'},
                $v->{'volstatus'},
                ], \@tds);
            }
        print &ui_columns_end();
        print &select_all_link("d", 1),"\n";
        print &select_invert_link("d", 1),"<br>\n";
        print &ui_form_end([ [ "delete",$text{'poolstatus_delete'} ] ]);
        }
    else {
        print "<b>$text{'poolstatus_none'}</b><p>\n";
        }
    }

&ui_print_footer("", $text{'index_return'});

sub joblink
{
return $jobs{$_[0]} ? "<a href='edit_job.cgi?name=".&urlize($_[0])."'>$_[0]</a>" : $_[0];
}


:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0107 ]--