!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/alumni/inc/class/   drwxr-xr-x
Free 50.98 GB of 127.8 GB (39.89%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     comments.class.php (8.16 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

/********************************************************************************
    - MemHT Portal -
    
    Copyright (C) 2007-2008 by Miltenovik Manojlo
    http://www.memht.com
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your opinion) any later version.
    
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License along
    with this program; if not, see <http://www.gnu.org/licenses/> (GPLv2)
    or write to the Free Software Foundation, Inc., 51 Franklin Street,
    Fifth Floor, Boston, MA02110-1301, USA.
        
********************************************************************************/

class comments {
    
//==============================
    //DEFAULT CONFIGURATION
    //==============================
    
var $whr 0//Where
    
var $wid 0//Item id
    
    //==============================
    //DO NOT EDIT
    //==============================
    
    
    //PHP5 Constructor
    
function __construct() {}
    
//PHP4 Constructor
    
function comments() {}
    
    
//Show comments
    
function show() {
        global 
$dblink,$siteConfig,$admin,$user;
        
        
?>
        <script type="text/javascript">
            <!--
            $(document).ready(function() {
                /* Show form */
                $("#std_showcomments").click(function(){
                    $("#std_showcomments").hide();
                    $("#std_showcomments_form").slideDown("slow");
                });
                
                /* Submit comment */
                $('#submitcomment').click(function() {
                    var name = escape($.trim($('input#form_name').val()));
                    var email = escape($.trim($('input#form_email').val()));
                    var text = escape($.trim($('textarea#form_text').val()));
                    var code = escape($.trim($('input#form_code').val()));

//-----witty
                    text = unescape(text);
//-----witty

                    /* Reset */
                    $('div#form_name_info').html('');
                    $('div#form_email_info').html('');
                    $('div#form_text_info').html('');
                    $('div#form_code_info').html('');
                    $('div#std_form_info').html('');
                    
                    /* Validate */
                    var save = true;
                    if (name=="") {
                        save = false;
                        $('div#form_name_info').html('<div style="color:#900; font-weight:bold;"><?php echo _FIELD_." ".strtolower(_REQUIRED_); ?></div>');
                    }
                    if (email=="") {
                        save = false;
                        $('div#form_email_info').html('<div style="color:#900; font-weight:bold;"><?php echo _FIELD_." ".strtolower(_REQUIRED_); ?></div>');
                    }
                    if (text=="") {
                        save = false;
                        $('div#form_text_info').html('<div style="color:#900; font-weight:bold;"><?php echo _FIELD_." ".strtolower(_REQUIRED_); ?></div>');
                    }
                    <?php
                    
if (extension_loaded('gd') AND $siteConfig['graphic_check']==1) {
                        
?>
                        if (code=="") {
                            save = false;
                            $('div#form_code_info').html('<div style="color:#900; font-weight:bold;"><?php echo _FIELD_." ".strtolower(_REQUIRED_); ?></div>');
                        }
                        <?php
                    
}
                    
?>
                    if (save) {
                        var glue = "&";
                        $.ajax({
                            type: "POST",
                            url: "inc/ajax/ajax_comments.php",
                            cache: false,
                            data: "op=add"+glue+"wid="+<?php echo $this->wid?>+glue+"whr="+<?php echo $this->whr?>+glue+"name="+name+glue+"email="+email+glue+"code="+code+glue+"text="+text,
                            success: function(data,textStatus) {
                                $('div#std_comment_target').append(data);
                                reloadCaptcha();
                            }
                        });
                     }
                });
            });
            
            /* Delete comment */
            function deletecom(cid) {
                <?php
                
if (isAdmin($admin)) {
                
?>
                    var glue = "&";
                    $.ajax({
                        type: "POST",
                        url: "inc/ajax/ajax_comments.php",
                        cache: false,
                        data: "op=delete"+glue+"wid="+cid,
                        success: function(data,textStatus) {
                            $('div#std_form_info').html(data);
                        }
                    });
                <?php
                
} else {
                
?>
                    alert('<?php echo _ACCESSDENIED_?>');
                <?php
                
}
                
?>
            }
            
            function reloadCaptcha() {
                var date = new Date();
                $('img#std_captcha').attr('src','<?php echo $siteConfig['site_url']; ?>/imgCode.php?name=chk_code&nc='+date.getTime());
            }
            -->
        </script>
        <?php    
        
        
        
if ($siteConfig['usecomments']==1) {
            echo 
"<div class='underlined info' style='margin:4px 0; font-size:120%;'><img src='images/note.gif' border='0' alt='Comments'> <a name='comments'><b>"._COMMENTS_."</b></a></div>\n";
            if (
$result $dblink->get_list("SELECT *,DATE_FORMAT(date,'".$siteConfig['timestamp']."') as date_out FROM memht_comments WHERE whr=".$this->whr." AND wid=".$this->wid." AND moderate=0 ORDER BY id")) {
                foreach (
$result as $row) {
                    
$cid intval($row['id']);
                    
$cname outCode($row['name']);
                    
$ctext censure(minibb2html(outCode($row['text'],0)));
                    
$cdate_out $row['date_out'];
                    
$cdate $row['date'];
                    
$cguest intval($row['guest']);
                    
$ip outCode($row['ip']);
                    
                    
$op = (isAdmin($admin)) ? " <a href='javascript:void(0);' onClick=\"deletecom('$cid');\" title='"._DELETECOMMENT_."'>("._DELETE_.")</a>" "" ;
                    
$link = ($cguest==0) ? "href='index.php?page=users&op=userInfo&usert=$cname'" "" ;
                    
                    
$cdate explode(" ",$cdate);
                    
$cdate explode("-",$cdate[0]);
                    
$cday $cdate[2];
                    
$cmonth $cdate[1];
                    
$cmonth numToMonth($cmonth,1);
                    
                    echo 
"<div class='tpl_comments_box' id='std_commentitem_$cid'>\n";
                        echo 
"<table width='100%' cellpadding='0' cellspacing='0'><tr><td valign='top'><a $link title='header=["._INFORMATIONS_."] body=[<b>"._DATE_.":</b> $cdate_out";
                        if (
isAdmin($admin)) { echo "<br><b>"._IP_.":</b> $ip"; }
                        echo 
"]'><span class='tpl_comments_title'><b>$cname</b></span></a>$op<div class='tpl_comments_body'>$ctext</div></td><td width='1%' valign='top'><div class='datebox'><div class='datebox_day'>$cday</div><div class='datebox_month'>$cmonth</div></div></td></tr></table>\n";
                    echo 
"</div>\n";
                }
            } else {
                echo 
"<div class='tpl_comments_box' id='std_form_comment_empty'>\n";
                    echo 
"<div class='info' align='center'>"._NOCOMMENTS_."</div>";
                echo 
"</div>\n";
            }
            echo 
"<div id='std_comment_target'></div>";
            echo 
"<div id='std_form_info'></div>";
            echo 
"<input type='button' id='std_showcomments' value='"._ADDCOMMENT_."'>\n";
            
//Form
            
echo "<div class='box' id='std_showcomments_form' style='display:none;'>\n";
            if (
$siteConfig['guest_comment']==|| isUser($user)) {
                if (
isUser($user)) {
                    
$row $dblink->get_row("SELECT email FROM memht_utenti WHERE user='$user'");
                    
$email outCode($row['email']);
                } else { 
$email ""; }
                    
                echo 
"<div class='info'>"._NAME_."<div id='form_name_info'></div><input type='text' id='form_name' value=\"$user\" size='40' maxlength='255'></div>\n";
                echo 
"<div class='info' style='margin:4px 0;'>"._EMAIL_."<div id='form_email_info'></div><input type='text' id='form_email' value=\"$email\" size='40' maxlength='255'></div>\n";
                echo 
"<div class='info'>"._TEXT_."<div id='form_text_info'></div>";
                    echo 
"<textarea id='form_text' rows='7' cols='40' style='width:99%; height:100px;'></textarea>";
                echo 
"</div>\n";
                if (
extension_loaded('gd') AND $siteConfig['graphic_check']==1) {
                    echo 
"<div style='padding:4px 0;'><img src='".$siteConfig['site_url']."/imgCode.php?name=chk_code&nc=".md5(time()+rand())."' title='header=["._SECURITY_CODE_."] body=["._SECURITY_CODE_TEXT_."]' id='std_captcha' alt='Captcha'></div>";
                    echo 
"<div class='info'>"._CODE_."<div id='form_code_info'></div><input type='text' id='form_code' size='10' maxlength='255'></div>\n";
                }
                echo 
"<div style='margin-top:4px;'><input type='submit' name='Submit' value='"._ADDCOMMENT_."' id='submitcomment'></div>\n";
            } else {
                echo 
"<div align='center'>"._DOTHE_." <a href='index.php?page=users' title='"._LOGIN_."'>"._LOGIN_."</a> "._OR_." <a href='index.php?page=users&op=register' title='"._REGISTER_."'>"._REGISTER_."</a> "._FORFREETOADDCOMMENTS_."</div>";
            }
        }
    }
}

?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0172 ]--