!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/libexec/webmin/postfix/   drwxr-xr-x
Free 50.94 GB of 127.8 GB (39.86%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     save_map.cgi (2.56 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
#!/usr/bin/perl
#
# postfix-module by Guillaume Cottenceau <gc@mandrakesoft.com>,
# for webmin by Jamie Cameron
#
# Save, modify, delete a map for Postfix


require './postfix-lib.pl';

&ReadParse();


#     &ui_print_header(undef, $text{'aliases_title'}, "");

&error_setup($text{'map_save_err'});


my $maps = &get_maps($in{'map_name'});
my $add = 1; my %map;
## added to split main_parameter:sub_parameter
my ($mainparm,$subparm)=split /:/,$in{'map_name'};

foreach $trans (@{$maps})
{
    if ($trans->{'number'} == $in{'num'}) { $add = 0; %map = %{$trans}; }
}

my @maps_files = &get_maps_files(&get_current_value($in{'map_name'}));
if ($add) {
    # Last file must editable
    !@maps_files ||
        &is_under_directory($access{'dir'}, $maps_files[$#maps_files]) ||
            &error(&text('mapping_ecannot', $access{'dir'}));
} else {
    # Map must be in an editable file
    !$map{'map_file'} ||
        &is_under_directory($access{'dir'}, $map{'map_file'}) ||
        &error(&text('mapping_ecannot', $access{'dir'}));
}

defined($maps_files[0]) || &error($text{'mapps_no_map_file'});
&lock_alias_files(\@maps_files);

if (!$in{'delete'}) {
    # Validate inputs
    ##$nfunc = "parse_name_".$in{'map_name'};
    ## modified to capture subparameters
    $nfunc="parse_name_"; $nfunc.=($subparm)? $subparm : $mainparm;
    if (defined(&$nfunc)) {
        $in{'name'} = &$nfunc(\%map, \%in);
        }
    else {
        $in{'name'} =~ /^\S+$/ || &error($text{'map_noname'});
        }
    ##$vfunc = "parse_value_".$in{'map_name'};
    ## modified to capture subparameters
    $vfunc="parse_value_"; $vfunc.=($subparm)? $subparm : $mainparm;
    if (defined(&$vfunc)) {
        $in{'value'} = &$vfunc(\%map, \%in);
        }
    }

if ($in{'delete'})
{
    if ($add == 1)
    {
    $whatfailed = "";
    &error(&text('map_delete_failed', $text{'map_delete_create'}));
    }
    &delete_mapping($in{'map_name'}, \%map);
    $logmap = \%map;
    $action = "delete";
}
elsif ($add == 0)
{
    # modify an existing map
    local %newmap = ( 'name' => $in{'name'},
              'value' => $in{'value'},
              'cmt' => $in{'cmt'} );
    &modify_mapping($in{'map_name'}, \%map, \%newmap);
    $logmap = \%newmap;
    $action = "modify";
}
else
{
    # add a new map -- much more easy! :-)
    local %newmap = ( 'name' => $in{'name'},
              'value' => $in{'value'},
              'cmt' => $in{'cmt'} );
    &create_mapping($in{'map_name'}, \%newmap);
    $logmap = \%newmap;
    $action = "create";
}
&unlock_alias_files(\@maps_files);

# re-creates database
&regenerate_map_table($in{'map_name'});
&reload_postfix();

&webmin_log($action, $in{'map_name'}, $logmap->{'name'}, $logmap);

&redirect_to_map_list($in{'map_name'});


:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0108 ]--