!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/share/doc/m2crypto-0.16/demo/medusa/   drwxr-xr-x
Free 51.93 GB of 127.8 GB (40.63%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     poison_handler.py (1.76 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |

import string
import whrandom

RESP_HEAD="""\
<HTML><BODY BGCOLOR=\"#ffffff\">
"""

RESP_MIDDLE="""
<h2>M2Crypto https server demonstration</h2>

This web page is generated by the "poison" http request handler. 
<br>
The links just go on and on and on...
<br><br>
"""

RESP_TAIL="""
</BODY></HTML>
"""

charset='012345678/90ABCDEFGHIJKLM/NOPQRSTUVWXYZabcd/efghijklmnopqrs/tuvwxyz'
numchar=len(charset)

def makepage(numlinks):

    title='<title>'
    for u in range(whrandom.randint(3, 15)):
        pick=whrandom.randint(0, numchar-1)
        title=title+charset[pick]
    title=title+'</title>'

    url='\r\n'
    numlinks=whrandom.randint(2, numlinks)
    for i in range(numlinks): 
        url=url+'<a href="/poison/'
        for u in range(whrandom.randint(3, 15)):
            pick=whrandom.randint(0, numchar-1)
            ch=charset[pick]
            if ch=='/' and url[-1]=='/':
                ch=charset[pick+1]
            url=url+ch
        url=url+'/">'
        for u in range(whrandom.randint(3, 15)):
            pick=whrandom.randint(0, numchar-1)
            url=url+charset[pick]
        url=url+'</a><br>\r\n'

    url=RESP_HEAD+title+RESP_MIDDLE+url+RESP_TAIL
    return url


class poison_handler:
    """This is a clone of webpoison - every URL returns a page of URLs, each of which 
    returns a page of URLs, each of _which_ returns a page of URLs, ad infinitum.
    The objective is to sucker address-harvesting bots run by spammers."""

    def __init__(self, numlinks=10):
        self.numlinks = numlinks
        self.poison_level = 0

    def match(self, request):
        return  (request.uri[:7] == '/poison')

    def handle_request(self, request):
        if request.command == 'get':
            request.push(makepage(self.numlinks))
        request.done()


:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0124 ]--