!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/libexec/webmin/postfix/   drwxr-xr-x
Free 50.94 GB of 127.8 GB (39.86%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     save_alias.cgi (2.67 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
#!/usr/bin/perl
#
# postfix-module by Guillaume Cottenceau <gc@mandrakesoft.com>,
# for webmin by Jamie Cameron
#
# Save, modify, delete an alias for Postfix


require './postfix-lib.pl';
&ReadParse();

$access{'aliases'} || &error($text{'aliases_ecannot'});
&error_setup($text{'alias_save_err'});

# Get the alias (if editing or deleting)
@afiles = &get_aliases_files(&get_current_value("alias_maps"));
@aliases = &list_postfix_aliases();
if (!$in{'new'}) {
    $a = $aliases[$in{'num'}];
    }
&lock_alias_files(\@afiles);

if ($in{'delete'}) {
    # delete some alias
    &delete_postfix_alias($a);
    $loga = $a;
    }
else {
    # saving or creating .. check inputs
    $in{'name'} =~ /^[^:@ ]+$/ ||
        &error(&text('asave_eaddr', $in{'name'}));
    if ($in{'new'} || uc($a->{'name'}) ne uc($in{'name'})) {
        # is this name taken?
        for($i=0; $i<@aliases; $i++) {
            if (uc($in{'name'}) eq uc($aliases[$i]->{'name'})) {
                &error(&text('asave_ealready', $in{'name'}));
                }
            }
        }
    for($i=0; defined($t = $in{"type_$i"}); $i++) {
        $v = $in{"val_$i"};
        $v =~ s/^\s+//;
        $v =~ s/\s+$//;
        if ($t == 1 && $v !~ /^(\S+)$/) {
            &error(&text('asave_etype1', $v));
            }
        elsif ($t == 3 && $v !~ /^\/(\S+)$/) {
            &error(&text('asave_etype3', $v));
            }
        elsif ($t == 4) {
            $v =~ /^(\S+)/ || &error($text{'asave_etype4none'});
            -x $1 || &error(&text('asave_etype4', $1));
            }
        elsif ($t == 5 && $v !~ /^\/(\S+)$/) {
            &error(&text('asave_etype5', $v));
            }
        elsif ($t == 6 && $v !~ /^\/(\S+)$/) {
            &error(&text('asave_etype6', $v));
            }
        if ($t == 1 || $t == 3) { push(@values, $v); }
        elsif ($t == 2) { push(@values, ":include:$v"); }
        elsif ($t == 4) { push(@values, "|$v"); }
        elsif ($t == 5) {
            # Setup autoreply script
            push(@values, "|$module_config_directory/autoreply.pl ".
                      "$v $in{'name'}");
            &system_logged("cp autoreply.pl $module_config_directory");
            &system_logged("chmod 755 $module_config_directory/config");
            }
        elsif ($t == 6) {
            # Setup filter script
            push(@values, "|$module_config_directory/filter.pl ".
                      "$v $in{'name'}");
            &system_logged("cp filter.pl $module_config_directory");
            &system_logged("chmod 755 $module_config_directory/config");
            }
        }

    $newa{'name'} = $in{'name'};
    $newa{'values'} = \@values;
    if (defined($in{'cmt'})) {
        $newa{'cmt'} = $in{'cmt'};
        }
    $newa{'enabled'} = $in{'enabled'};
    if ($in{'new'}) {
        &create_postfix_alias(\%newa);
        }
    else {
        &modify_postfix_alias($a, \%newa);
        }
    $loga = \%newa;
    }
&unlock_alias_files(\@afiles);

# re-creates aliases database
&regenerate_aliases();
&reload_postfix();

&webmin_log($in{'new'} ? 'create' : $in{'delete'} ? 'delete' : 'modify',
        'alias', $loga->{'name'}, $loga);
&redirect("aliases.cgi");





:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0132 ]--