!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/libexec/webmin/syslog-ng/   drwxr-xr-x
Free 49.58 GB of 127.8 GB (38.8%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     save_filter.cgi (3.67 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
#!/usr/bin/perl
# Create, update or delete a log filter

require './syslog-ng-lib.pl';
&ReadParse();
&error_setup($text{'filter_err'});

# Get the old filter
$conf = &get_config();
if (!$in{'new'}) {
    @filters = &find("filter", $conf);
    ($filter) = grep { $_->{'value'} eq $in{'old'} } @filters;
    $filter || &error($text{'filter_egone'});
    $old = $filter;
    }
else {
    $filter = { 'name' => 'filter',
          'type' => 1,
          'members' => [ ] };
    }

&lock_file($config{'syslogng_conf'});
if ($in{'delete'}) {
    # Just delete it!
    &check_dependencies('filter', $in{'old'}) &&
        &error(&text('fdelete_eused', $in{'old'}));
    &save_directive($conf, undef, $filter, undef, 0);
    }
else {
    # Validate inputs, and update object
    $in{'name'} =~ /^[a-z0-9_]+$/i || &error($text{'filter_ename'});
    if ($in{'new'} || $in{'old'} ne $in{'name'}) {
        ($clash) = grep { $_->{'value'} eq $in{'name'} } @filters;
        $clash && &error($text{'filter_eclash'});
        }
    $filter->{'values'} = [ $in{'name'} ];

    # Clear out current values
    $filter->{'members'} = [ ];

    if ($in{'mode'} == 0) {
        if ($in{'priority'}) {
            # Add selected priorities
            @pris = split(/\0/, $in{'pri'});
            @pris || &error($text{'filter_epris'});
            @pris = map { (",", $_) } @pris;
            shift(@pris);    # remove first ,
            push(@{$filter->{'members'}}, "and",
                 { 'name' => 'priority',
                   'type' => 0,
                   'values' => \@pris });
            }

        if ($in{'facility'}) {
            # Add selected facilities
            @facs = split(/\0/, $in{'fac'});
            @facs || &error($text{'filter_efacs'});
            @facs = map { (",", $_) } @facs;
            shift(@facs);    # remove first ,
            push(@{$filter->{'members'}}, "and",
                 { 'name' => 'facility',
                   'type' => 0,
                   'values' => \@facs });
            }

        if ($in{'program'}) {
            $in{'prog'} =~ /^\S+$/ || &error($text{'filter_eprog'});
            push(@{$filter->{'members'}}, "and",
                 { 'name' => 'program',
                   'type' => 0,
                   'values' => [ $in{'prog'} ] });
            }

        if ($in{'match'}) {
            $in{'re'} =~ /\S/ || &error($text{'filter_ematch'});
            push(@{$filter->{'members'}}, "and",
                 { 'name' => 'match',
                   'type' => 0,
                   'values' => [ $in{'re'} ] });
            }

        if ($in{'host'}) {
            $in{'hn'} =~ /^\S+$/ || &error($text{'filter_ehost'});
            push(@{$filter->{'members'}}, "and",
                 { 'name' => 'host',
                   'type' => 0,
                   'values' => [ $in{'hn'} ] });
            }

        if ($in{'netmask'}) {
                &check_ipaddress($in{'net'}) ||
                  &error($text{'filter_enet'});
                &check_ipaddress($in{'mask'}) ||
                  &error($text{'filter_emask'});
            push(@{$filter->{'members'}}, "and",
                 { 'name' => 'netmask',
                   'type' => 0,
                   'values' => [ $in{'net'}."/".$in{'mask'} ] });
            }

        if (@{$filter->{'members'}}) {
            # Remove first 'and'
            shift(@{$filter->{'members'}});
            }
        else {
            &error($text{'filter_enone'});
            }
        }

    else {
        # Parse boolean expression (in a temp file), and add to values
        $temp = &transname();
        &open_tempfile(TEMP, ">$temp", 0, 1);
        &print_tempfile(TEMP, "filter xxx {\n");
        &print_tempfile(TEMP, $in{'bool'},"\n");
        &print_tempfile(TEMP, "};\n");
        &close_tempfile(TEMP);
        eval {
          $main::error_must_die = 1;
          ($tfilter) = &read_config_file($temp);
          };
        $@ && &error($text{'filter_ebool'});
        unlink($temp);
        $filter->{'members'} = $tfilter->{'members'};
        }
    
    # Actually update the object
    &save_directive($conf, undef, $old, $filter, 0);

    # Update dependent log targets
    if (!$in{'new'}) {
        &rename_dependencies('filter', $in{'old'}, $in{'name'});
        }
    }

&unlock_file($config{'syslogng_conf'});
&webmin_log($in{'delete'} ? 'delete' : $in{'new'} ? 'create' : 'modify',
        'filter', $in{'old'} || $in{'name'});
&redirect("list_filters.cgi");


:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0088 ]--