!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/libexec/webmin/fsdump/   drwxr-xr-x
Free 50.94 GB of 127.8 GB (39.86%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     save_dump.cgi (3.79 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
#!/usr/bin/perl
# save_dump.cgi
# Save the details of a scheduled backup

require './fsdump-lib.pl';
&foreign_require("cron", "cron-lib.pl");
&ReadParse();
&error_setup($text{'save_err'});

# Create wrapper for ftp transfer script
&cron::create_wrapper($ftp_cmd, $module_name, "ftp.pl");

if ($in{'id'}) {
    $dump = &get_dump($in{'id'});
    $access{'edit'} && &can_edit_dir($dump) ||
        &error($text{'dump_ecannot2'});
    @jobs = &foreign_call("cron", "list_cron_jobs");
    foreach $j (@jobs) {
        $job = $j if ($j->{'command'} eq "$cron_cmd $dump->{'id'}");
        }
    $oldenabled = $dump->{'enabled'};
    }
else {
    $access{'edit'} || &error($text{'dump_ecannot1'});
    }

if ($in{'delete'}) {
    # Just delete this dump
    &delete_dump($dump);
    if ($job) {
        &lock_file($job->{'file'});
        &foreign_call("cron", "delete_cron_job", $job);
        &unlock_file($job->{'file'});
        }
    delete($dump->{'pass'});
    &webmin_log("delete", undef, $dump->{'id'}, $dump);
    &redirect("");
    }
elsif ($in{'restore'}) {
    # Redirect to restore form
    &redirect("restore_form.cgi?fs=$dump->{'fs'}&id=$in{'id'}");
    }
else {
    # Validate and store inputs
    if (&multiple_directory_support($in{'fs'})) {
        $in{'dir'} =~ s/[\r\n]+/\t/g;
        foreach $d (split(/\t+/, $in{'dir'})) {
            -d $d || &error($text{'save_edir'});
            if ($in{'fs'} ne 'tar') {
                $fs = &directory_filesystem($d);
                &same_filesystem($fs, $in{'fs'}) ||
                    &error($text{'save_efs'});
                }
            &can_edit_dir($d) || &error($text{'dump_ecannot3'});
            }
        $in{'dir'} || &error($text{'save_edir'});
        $dump->{'tabs'} = 1;    # tab used to split dirs
        }
    else {
        -d $in{'dir'} || &error($text{'save_edir'});
        if ($in{'fs'} ne 'tar') {
            $fs = &directory_filesystem($in{'dir'});
            &same_filesystem($fs, $in{'fs'}) ||
                &error($text{'save_efs'});
            }
        &can_edit_dir($in{'dir'}) || &error($text{'dump_ecannot3'});
        }
    $dump->{'dir'} = $in{'dir'};
    $dump->{'fs'} = $in{'fs'};
    $dump->{'email'} = $in{'email'};
    $dump->{'subject'} = $in{'subject_def'} ? undef : $in{'subject'};
    if ($access{'extra'}) {
        $dump->{'extra'} = $in{'extra'};
        }
    if ($access{'cmds'}) {
        $dump->{'before'} = $in{'before'};
        $dump->{'after'} = $in{'after'};
        $dump->{'beforefok'} = !$in{'beforefok'};
        $dump->{'afterfok'} = !$in{'afterfok'};
        }
    $in{'file'} =~ s/^\s+//; $in{'file'} =~ s/\s+$//;
    $in{'hfile'} =~ s/^\s+//; $in{'hfile'} =~ s/\s+$//;
    &parse_dump($dump);
    $dump->{'reverify'} = $in{'reverify'} if (defined(&verify_dump));
    $dump->{'enabled'} = $in{'enabled'};
    $dump->{'follow'} = $in{'enabled'} == 2 ? $in{'follow'} : undef;
    &foreign_call("cron", "parse_times_input", $dump, \%in);

    # Create or update the dump and cron job
    &lock_file($cron_cmd);
    &cron::create_wrapper($cron_cmd, $module_name, "backup.pl");
    &unlock_file($cron_cmd);
    &save_dump($dump);
    local $oldjob = $job;
    if ($dump->{'enabled'} == 1) {
        # Create cron job and script
        $job->{'user'} = 'root';
        $job->{'active'} = 1;
        $job->{'special'} = $dump->{'special'};
        $job->{'mins'} = $dump->{'mins'};
        $job->{'hours'} = $dump->{'hours'};
        $job->{'days'} = $dump->{'days'};
        $job->{'months'} = $dump->{'months'};
        $job->{'weekdays'} = $dump->{'weekdays'};
        $job->{'command'} = "$cron_cmd $dump->{'id'}";
        }
    &lock_file(&cron::cron_file($job)) if ($job);
    if ($dump->{'enabled'} == 1 && !$oldjob) {
        # Create the cron job
        &foreign_call("cron", "create_cron_job", $job); 
        }
    elsif ($dump->{'enabled'} == 1 && $oldjob) {
        # Update the cron job
        &foreign_call("cron", "change_cron_job", $job); 
        }
    elsif ($dump->{'enabled'} != 1 && $oldjob) {
        # Delete the cron job
        &foreign_call("cron", "delete_cron_job", $job);
        }
    &unlock_file(&cron::cron_file($job)) if ($job);

    delete($dump->{'pass'});
    &webmin_log($in{'id'} ? "modify" : "create", undef,
            $dump->{'id'}, $dump);
    if ($in{'savenow'}) {
        &redirect("backup.cgi?id=$dump->{'id'}");
        }
    else {
        &redirect("");
        }
    }


:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0105 ]--