!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/share/locale/C/LC_MESSAGES/   drwxr-xr-x
Free 51.95 GB of 127.8 GB (40.65%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     html (13.75 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
msgcc 2005-12-23ë‚1‚1)#+5) &&000$)9I , ET =6`/l‚_ `   * \* ^B'=K‚%R=F2K‚/G$qzxpD.10/ƒ c 9KR$[ ‚,/ 0.0 ‚\ Cu(  y‚ oc#CS on line %d has no matching <%s>: unknown tag has no matching <%s>%s: pop diversion `%s'BREAK %s:%d: it.center=%d it.count=%dEXPAND +++ `%s'EXPAND --- `%s'DROP %d %d %d:%d %d:%dIE +++ %s level=%d |%s%s%s%s%sIE --- %s level=%d |%s%s%s%s%sFIND %s => %sINTERRUPT %s:%d: it.center=%d it.count=%d it.dtLIST %d %d %d:%d %d:%d ops=%d df=%d dc=%d dl=%dTEST %d %d %d:%d %d:%d ops=%d df=%d dc=%d dl=%dget macro %s `%s'get register %s %d %dgroup end tag %s not foundinput stack overflowinternal error: <%s%s%s %d> ignorediop %s lookup failedlist stack overflowout of space [%s]out of space [arg buffer]out of space [dict]out of space [dir]out of space [divert]out of space [hosts]out of space [entity hash put]out of space [entity hash]out of space [environment]out of space [file hash]out of space [file pushin]out of space [file]out of space [hot]out of space [mac]out of space [macro call]out of space [macros]out of space [nul buffer]out of space [number]out of space [output]out of space [path pattern]out of space [ref buffer]out of space [render]out of space [req buffer]out of space [root]out of space [script]out of space [set value]out of space [state]out of space [stream path]out of space [stream]out of space [subject]out of space [symbol hash]out of space [tag hash put]out of space [tag hash]out of space [tag stack]out of space [tag]out of space [tmp buffer]out of space [top buffer]out of space [trap]out of space [var hash put]output stack overflowremove macro %sremove register %sset macro %s `%s'set register %s %d %dtag stack overflowtag stack underflow trying to match <%s>unbalanced \{ ... \} blockhtml2rtf - html to rtf filterhtml2rtf converts input html documents to an RTF document on the standard output. html2rtf expects properly nested begin/end tags in the input html and warns about imbalance.debugSet the debug trace level to level. Higher levels produce more output.levelfont-sizeSet the initial font size to size points.size:=12project-fileAppends MS HELP project information to the help project file file. This file combines individual RTF files into a hyper-linked collection. Note that MS expects file to have a .hlp extension.fileverboseEnable verbose error and warning messages. Some html source can't stand the heat.[ file ... ]man(1), mm(1), mm2html(1), troff(1), troff2html(1)html2db - extract flat file database from html tableshtml2db extracts a flat file database from tables in the input html files. If file is not specified then the standard input is read. The html parse is rudimentary; don't use html2db to detect valid html files.html2rtf(1)troff2html - convert troff/groff input to htmltroff2html converts troff(1) (or groff(1), depending on the processing mode) input documents to an html document on the standard output. Although a full troff parse is done, many features are ignored in the mapping to html.The troff t condition test evaluates true, the n condition tests evaluates false, and the groff compatibility register \\n[.C] evaluates to 0 (enable groff parsing) if it is referenced before the first groff .cp (compatibility mode) request.The generated html has properly nested begin/end tags, even though most browsers don't care.identifyReads identification options from file. Unknown options are silently ignored. See the .xx request below for a description of the options.includeAppends directory to the list of directories searched for --macros and .so request files.directorymacrosLocates and reads the macro package file package. In order to accomodate different troff installation styles the file search order is fairly involved:packagefor all --include directoriesfor all directories on $PATHregisterInitializes the number register to N.registerNscriptReads script as if it came from a file. --script='.nr A 123' is equivalent to -rA123.Enables verbose error and warning messages. Following troff tradition, troff2html by default does not warn about unknown requests; --verbose enables such warnings.EXTENSIONS.xx name[=value] is a special troff2html request that handles program tracing, html extensions and troff macro package magic that went way past the author's willingness to understand. Supported operations are:Specifies the contact information for the document HEAD section.Specifies the document background URL.The debug trace level; higher levels produce more output.Traces each get for the named number register. - turns tracing off.Adds (+) or removes (-) word ... from the hot-word list. Constructs that match (hot-word ... SWITCH-FONT text SWITCH-FONT ... ) adds text as a hot link to another portion of the document. refer and see are the default hot words. Case is ignored when matching hot words.Specifies the logo/banner image URL that is centered at the top of the document.Sets the email address to send comments and suggestions.Emits the html tag .text is prepended to the html document title.Traces each set for the named number register. - turns tracing off.Sets the document title.Local URL links are generated for all top level headings. These can be referenced by embedding the benign (albeit convoluted) troff construct \h'0*\w"label"'text\g'0', where label is the local link label and text is the hot link text. If label and text are the same then use \h'0*1'text\h'0'.groff(1), html2rtf(1), man(1), mm(1), mm2html(1), troff(1)htmlrefs - list html url referenceshtmlrefs lists url references from the local closure of the input html files. If file is not specified then the top level default user file is read. The html parse is rudimentary; don't use htmlrefs to detect valid html files.The top level references are determined in this order (the --index, --root and --user options influence the order):Pseudo index containing  references to top level directories. type may be one of:The document root directory containing URL target documents. Exactly one document-root must be specified.The program root directory containing CGI support programs and scripts. This type is optional. If specified then the program root directory should contain a pseudo index for its references.The data root directory containing CGI support data. This type is optional. If specified then the data root directory should contain a pseudo index for its references.All files under dir are considered referenced.dir is a ksh(1) pattern of paths to ignore.allList all references whether they exist or not.copyCopy the selected references to directory which must already exist. If --external is also specified then lines between  ...  lines are not copied. If --unreferenced is also specified then files and directories in directory that have not been copied are removed. Target file modification times are set to match source times so that future copies can be avoided.dependentsList each selected local file followed by : and a list of all local files referring to the file.externalDo not list references inside  ...  lines. See mm2html(1) for an html generator that inserts these lines.forceBy default files are not copied if the source and target size and modification times match. --force forces all files to be copied.indexname specifies the page named by directory references.name:=index.htmlhostsCheck only references matching the ksh(1) pattern http://pattern/.patternkeeppattern is used to match file base names that are always considered referenced.pattern:=.htaccessmissingList missing local file references.execEnable file modification operations. --noexec lists the operations but does not do them.perlwarnCheck HTML files for unintentional embedded perl(1) constructs: a left bracket followed by one of -+!$*#. Manually translating left bracket to [ avoids unwanted perl interactions (why didn't they use tags like everyone else?) mm2html(1) and optget(3) do the translation by default.rootThe local directory for --user references.directory:=~userstrictBy default unreferenced --index files and the containing directory are considered referenced; --strict considers unreferenced --index files unreferenced.user~name translates to the --root directory.name:=caller-uidList files as they are copied (see --copy.)warnProduce a warning diagnostic for missing files.unreferencedIf --copy is also specified then remove files and directories in the --copy directory that have not been copied. Otherwise list unreferenced files in the --root directory. A directory that contains no referenced files but does contain an --index file is considered referenced (along with the --index file) unless --strict is enabled.file ...List missing references to the local host www.research.att.com.Copy the local hierarchy to ~/external/wwwfiles for external release, and remove unreferenced files in the copy.html2rtf(1), mm2html(1)mm2html - convert mm/man subset to htmlframeGenerate framed HTML files in:name.htmlThe main body.name-index.htmlTEXT beginname-temp.htmlsymlinkhtmlRead html options from file. Unknown options are silently ignored. See the .xx request below for a description of the options. The file pathname may be followed by URL style name=value pairs that are evaluated as if they came from file.file[?name=value;...]Read license identification options from file. Unknown options are silently ignored. See the .xx request below for a description of the options. The file pathname may be followed by URL style name=value pairs that are evaluated as if they came from file.optionSets a space or , separated list of --license options. Option values with embedded spaces must be quoted.[no]name=valueGenerate a standalone name-index.html for framed HTML where name is specified by --frame..xx name[=value] is a special mm2html request that handles program tracing, html extensions and troff macro package magic. Supported operations are:Specifies the contact information for the document HEAD section.Specifies the logo/banner image URL that is centered at the top of the document.Sets the email address to send comments and suggestions.Emits the html tag .Local URL links are generated for all top level headings. These can be referenced by embedding the benign (albeit convoluted) troff construct \h'0*\w"label"'text\h'0', where label is the local link label and text is the hot link text. If label and text are the same then use \h'0*1'text\h'0'.man(1) links are generated for bold or italic identifiers that are immediately followed by a parenthesized number.troff2html(1), html2rtf(1)download - generate web site download instructions for an mm documentdownload is a ksh(1) script that generates web site download instructions for an mm(1) document. item names the item to be downloaded and type ... names the supported architecture type(s) as reported by package(1).download is most often used in the .sh directive of mm2html(1) or troff2html(1): .sh download warp sgi.mips3 linux.i386.item [ type ... ]mm2html(1), package(1), troff2html(1)global-indexGenerate a standalone index.html for framed HTML.%s: cannot skipInstruct --copy to symlink(2) files that do not contain  ... .out of space [rootdir]topOpen non-local urls in the top frame.If --external is on then dir is a ksh(1) pattern of internal paths.mm2html is a sed(1)/ksh(1) script (yes!) that converts input mm(1) or man(1) documents to an html document on the standard output. If file is omitted then the standard input is read. troff2html(1) is similar but does a full troff(1) parse. dir operands and directory components of file operands are added to the included file search list.[ [ dir | file ] ... ]Provides a default value for the --hosts option.Files under this dir are accessed by https: only.limitLimit --copy and --remove operations to path names matching pattern.removeUnreferenced files are removed when --unreferenced and --nocopy are specified.The frame index (if --index specified).Temporary frame goto labels.

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0082 ]--