!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/share/doc/sane-backends-1.0.18/matsushita/   drwxr-xr-x
Free 50.94 GB of 127.8 GB (39.86%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     matsushita.txt (5.03 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
Made by Kyushu Matsushita Electric, a.k.a. Panasonic
http://www.kme.panasonic.co.jp/
http://panasonic.com/

The same twain driver handle these scanners:
Same family as  KV-SS25, KV-SS50, KV-SS55, KV-SS50EX, KV-SS55EX, KV-SS850, KV-SS855.

Another driver handle the KV-S2055L, KV-S2055W.

However all these scanner show similarities.

/*--------------------------------------------------------------------------*/

SCSI commands supported by the KV-SS25:

TEST UNIT READY:
00 00 00 00 00 00

REQUEST SENSE:
03 00 00 00 0E 00
  a return after a short read is:
      f0 00 60 00 00 00 02 0a 00 00 00 00 00 00 00 00
  a return after a jam (sure?)
      f0 00 03 00 00 00 00 0a 00 00 00 00 80 01 00 00
  no paper
      f0 00 03 00 00 00 00 0a 00 00 00 00 3a 00 00 00
  jam door open:
	  f0 00 02 00 00 00 00 0a 00 00 00 00 04 81 00 00
  paper jam
	  f0 00 03 00 00 00 00 0a 00 00 00 00 80 04 00 00
  after a power cycle
      f0 00 06 00 00 00 00 0a 00 00 00 00 29 00 00 00
  after ????
      f0 00 05 00 00 00 00 0a 00 00 00 00 2c 02 00 00
  out of memory (scan data too big for scanner)
      f0 00 05 00 00 00 00 0a 00 00 00 00 2c 80 00 00

INQUIRY:
12 00 00 00 60 00
  result:
    06 00 02 02 5B 00 00 10 4B 2E 4D 2E 45 2E 20 20 
    4B 56 2D 53 53 32 35 41 20 20 20 20 20 20 20 20 
    31 2E 30 35 00 00 00 00 00 00 00 00 00 00 00 00 
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

SET WINDOWS:
24 00 00 00 00 00 00 00 00 00
   reset (?)
24 00 00 00 00 00 00 00 48 00
   72 bytes.
   6-7 = 0x40 = window descriptor length
   
   Window Descriptor Block:
   0 = page side 
	 0x00 = front
	 0x80 = back
   2-3 = X resolution
   4-5 = Y Resolution
   14-17 = width  (size in inches * 1200)
   18-21 = length (size in inches * 1200)
   22 = 255 - brightness
   23 = same as 22
   24 = contrast
   25 = image composition
        0x00 = black&white (1 bit)
		0x01 = black&white with halftone pattern
		0x02 = grayscale
   26 = bits/pixel
        0x01, if image comp == 0
        0x04, if image comp == (0x01 || 0x02) -> grayscale 4 bits
		0x08, if image comp == 0x02 -> grayscale 8 bits
   28 = haltone pattern
      0x00 = Bayer 64
      0x01 = Bayer 16
	  0x02 = Dot 32
	  0x03 = Dot 64
	  0x04 = Error diffusion
	  0x80 = User downloaded pattern
   29 = reverse image
      0x00 = no reverse
      0x80 = reverse 
   43 = image emphasis
	  0x80 smooth
	  0x00 none
	  0x01 low
	  0x30 medium (twain default)
	  0x50 high
   44 = gamma (Gray 4/8 only)
      0x00 normal
	  0x01 from CRT
	  0x80 gamma table 0 (previously downloaded)
	  0x81 gamma table 1 (previously downloaded)
	  0x82 gamma table 2 (previously downloaded)
	  0x83 gamma table 3 (previously downloaded)
   47 = ? (only used by the ISIS driver)
      bit 7 = ? set by the ISIS driver
      bit 6 = length control
      bit 2 = ? set by the ISIS driver
      bit 1 = ? set by the ISIS driver
   48-51 = width (again?, maybe paper size)
   52-55 = length (again?, maybe paper size)
   57 = feeder mode
      0x00 = one page
	  other = number of pages to read (TWAIN driver defaults to 0xff)
   58 = auto threshold
      0x00 = none (twain default)
	  0x80 = mode 1
	  0x81 = mode 2
	  0x82 = mode 3
   59 = automatic separation
	  0x00 = no (twain default)
	  0x80 = yes 
   60 = white level
      0x00 = from white stick (twain default)
	  0x80 = from paper
	  0x81 = automatic
   61 = noise reduction
      0x00 = none (twain default)
	  0x01 = 1x1
	  0x02 = 2x2
	  0x03 = 3x3
	  0x04 = 4x4
	  0x05 = 5x5

READ:
28 00 80 00 00 00 00 00 10 00
28 00 00 00 00 00 00 80 00 00
   2 = data type code
	  0x00 image data
	    The TWAIN driver always reads 0x8000 bytes at the time, except for
		the last packet where it read the size left plus 2 more bytes (and
		thus generating a check condition).

        5: page side
		   0x00 = front
		   0x80 = back
  
      0x80 image size in dots
         3(?)-4: number of the page to read. Multipage mode.

         returns 16 bytes:
	       0-3: length in pixels
	       4-7: width in lines

SEND(10):
  2A 00 03 00 00 01 00 01 0A 00
  2 = data type code
    0x02 = halftone pattern 
       data is 10 bytes of header + 64 bytes for the matrix
    0x03 = gamma table
       data is 10 bytes of header + 256 bytes for the table
  5 = gamma table number (data type code is 2)
    the scanner can store 4 gamma tables (from 0 to 3)
  7-8 = length

SET AREA (?)
C0 00 00 00 00 00 00 00 58 00
Total message length = 88 bytes
  7     = length -> 0x40 = 64 bytes
  14-17 = area 1 X
  18-21 = area 1 Y
  22-25 = area 1 width
  26-29 = area 1 length
  33    = image composition
            1 = halftone
  36    = haltone pattern (if image composition == 1)
		    0x00 = Bayer 64
			0x01 = Bayer 16
			0x02 = Dot 32
			0x03 = Dot 64
			0x04 = Error diffusion
  50-53 = area 2 X
  54-57 = area 2 Y
  58-61 = area 2 width
  62-65 = area 2 length
  68-71 = area 3 X
  72-75 = area 3 Y
  76-79 = area 3 width
  80-83 = area 3 length


Other supported commands:
16 RESERVE UNIT
17 RELEASE UNIT
1D SEND DIAGNOSTIC
31 OBJECT POSITION
3B WRITE BUFFER

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0191 ]--