!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/libexec/webmin/bind8/   drwxr-xr-x
Free 50.94 GB of 127.8 GB (39.86%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     delete_recs.cgi (2.48 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
#!/usr/bin/perl
# Delete multiple records from a zone file

require './bind8-lib.pl';
&ReadParse();
&error_setup($text{'drecs_err'});
$zone = &get_zone_name_or_error($in{'zone'}, $in{'view'});
$dom = $zone->{'name'};
&can_edit_zone($zone) ||
    &error($text{'recs_ecannot'});
&can_edit_type($in{'type'}, \%access) ||
    &error($text{'recs_ecannottype'});

# Find the records
@d = split(/\0/, $in{'d'});
@d || &error($text{'drecs_enone'});

# Check if confirmation is needed
if (!$in{'confirm'} && $config{'confirm_rec'}) {
    # Ask first
    &ui_print_header(undef, $text{'drecs_title'}, "");

    print &ui_confirmation_form("delete_recs.cgi",
        &text('drecs_rusure', scalar(@d), $dom),
        [ [ 'zone', $in{'zone'} ],
          [ 'view', $in{'view'} ],
          [ 'rev', $in{'rev'} ],
          map { [ 'd', $_ ] } @d ],
        [ [ 'confirm', $text{'drecs_ok'} ] ],
        );

    &ui_print_footer("edit_recs.cgi?zone=$in{'zone'}&view=$in{'view'}&type=$in{'type'}&sort=$in{'sort'}", $text{'recs_return'});
    }
else {
    # Delete them
    @recs = &read_zone_file($zone->{'file'}, $dom);

    foreach $d (sort { $b <=> $a } @d) {
        ($num, $id) = split(/\//, $d, 2);
        $r = &find_record_by_id(\@recs, $id, $num);
        next if (!$r);
        if ($in{'rev'}) {
            # Find the reverse
            $fulloldvalue0 = &convert_to_absolute(
                        $r->{'values'}->[0], $dom);
            $fulloldname = &convert_to_absolute(
                        $r->{'name'}, $dom);
            ($orevconf, $orevfile, $orevrec) = &find_reverse(
                    $r->{'values'}->[0], $in{'view'});

            if ($orevrec && &can_edit_reverse($orevconf) &&
                $fulloldname eq $orevrec->{'values'}->[0] &&
                ($r->{'type'} eq "A" &&
                 $r->{'values'}->[0] eq &arpa_to_ip($orevrec->{'name'}) ||
                 $r->{'type'} eq "AAAA" &&
                 &expandall_ip6($r->{'values'}->[0]) eq &expandall_ip6(&ip6int_to_net($orevrec->{'name'})))) {
                &lock_file(&make_chroot($orevrec->{'file'}));
                &delete_record($orevrec->{'file'} , $orevrec);
                &lock_file(&make_chroot($orevfile));
                @orrecs = &read_zone_file($orevfile, $orevconf->{'name'});
                if (!$bumpedrev{$orevfile}++) {
                    &bump_soa_record($orevfile, \@orrecs);
                    }
                &sign_dnssec_zone_if_key($orevconf, \@orrecs);
                }
            }

        # Delete the actual record
        &lock_file(&make_chroot($r->{'file'}));
        &delete_record($r->{'file'}, $r);
        splice(@recs, $d, 1);
        }
    &bump_soa_record($zone->{'file'}, \@recs);
    &sign_dnssec_zone_if_key($zone, \@recs);
    &unlock_all_files();

    &webmin_log("delete", "recs", scalar(@d));
    &redirect("edit_recs.cgi?zone=$in{'zone'}&view=$in{'view'}&type=$in{'type'}&sort=$in{'sort'}");
    }



:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0148 ]--