!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/alumni/pages/guide/   drwxr-xr-x
Free 50.98 GB of 127.8 GB (39.89%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     index.php (8.49 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

/********************************************************************************
    - MemHT Portal -
    
    Copyright (C) 2007-2008 by Miltenovik Manojlo
    http://www.memht.com
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your opinion) any later version.
    
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License along
    with this program; if not, see <http://www.gnu.org/licenses/> (GPLv2)
    or write to the Free Software Foundation, Inc., 51 Franklin Street,
    Fifth Floor, Boston, MA02110-1301, USA.
        
********************************************************************************/

if (!defined("_LOAD_PAGE_")) {
    die(
"<table style='padding: 2px; border: 1px solid #999; background-color: #EEE; font-family: Verdana; font-size: 10px;' align='center'><tr><td><b>Error:</b> This file cannot be opened directly!</td></tr></table>");
}

//------
//whr: 2
//------

$op = (isset($_GET['op'])) ? inCode($_GET['op']) : "" ;

if (isset(
$_GET['id'])) { $id intval($_GET['id']); $title ""; } else {
    
$title = (isset($_GET['title'])) ? mem_urldecode(inCode($_GET['title'])) : "" ;
    
$id "";
}
if (isset(
$_GET['gid'])) { $gid intval($_GET['gid']); } else { $gid 0; }
if (isset(
$_GET['ok'])) { $ok inCode($_GET['ok']); } else { $ok false; }
if (isset(
$_GET['rank'])) { $rank inCode($_GET['rank']); } else { $rank ""; }

if (isset(
$_GET['pg'])) { $pg intval($_GET['pg']); } else { $pg 1; }
$ofsppg 60//Items per page
$ofsbgn = ($pg*$ofsppg)-$ofsppg;

function 
guideList() {
    global 
$dblink,$siteConfig;
    
    
openTable();
        if (
$result $dblink->get_list("SELECT * FROM memht_argomenti ORDER BY nome")) {
            foreach (
$result as $row) {
                
$ida intval($row['id']);
                
$inome outCode($row['nome']);
                
                if (
$dblink->get_num("SELECT id FROM memht_guide WHERE argomento=$ida AND enabled=1")>0) {
                    echo 
"<div><img src='images/bullet_paper.gif' border='0' alt='Bullet'> <a href='index.php?page=guide&op=arg&id=$ida&title=".mem_urlencode($inome)."' title='$inome'><b>$inome</b></a></div>\n";
                    
$result $dblink->get_list("SELECT *,DATE_FORMAT(data, '".$siteConfig['timestamp']."') as data FROM memht_guide WHERE argomento=$ida AND enabled=1 ORDER BY id DESC LIMIT 20");
                    foreach (
$result as $row) {
                        
$id intval($row['id']);
                        
$nome outCode($row['nome']);
                        
$autore outCode($row['autore']);
                        
$data $row['data'];
                        
$hits intval($row['hits']);
                        
                        echo 
"<div class='small'>&nbsp;&nbsp;- <a href='index.php?page=guide&op=readGuide&id=$id&title=".mem_urlencode($nome)."' title='$nome'>$nome</a></div>\n";
                    }
                    echo 
"<div class='small'>&nbsp;&nbsp;.. <a href='index.php?page=guide&op=arg&id=$ida&title=".mem_urlencode($inome)."' title='$inome'><i>"._COMPLETE_LIST_."</i></a></div>\n";
                    echo 
"<br><br>";
                }
            }
        } else {
            echo 
"<div align='center' id='errorText'><b>"._NOARGS_."</b></div>";
        }
    
closeTable();
}

function 
viewArgument($id,$title,$ofsbgn,$ofsppg,$pg) {
    global 
$dblink,$siteConfig;
    
    if (
$title!="") {
        
$row $dblink->get_row("SELECT id,nome FROM memht_argomenti WHERE nome='$title'");
        
$ida intval($row['id']);
        
$inome outCode($row['nome']);
    } else {
        
$ida intval($id);
        
$row $dblink->get_row("SELECT nome FROM memht_argomenti WHERE id=$ida");
        
$inome outCode($row['nome']);
    }
    
    
openTable();
        echo 
"<div><img src='images/bullet_paper.gif' border='0' alt='Bullet'> <a href='index.php?page=guide&op=arg&id=$ida&title=".mem_urlencode($inome)."' title='$inome'><b>$inome</b></a></div>\n";
        
        if (
$result $dblink->get_list("SELECT *,DATE_FORMAT(data, '".$siteConfig['timestamp']."') as data FROM memht_guide WHERE argomento=$ida AND enabled=1 ORDER BY id DESC LIMIT $ofsbgn,$ofsppg")) {
            foreach (
$result as $row) {
                
$id intval($row['id']);
                
$nome outCode($row['nome']);
                
$autore outCode($row['autore']);
                
$data $row['data'];
                
$hits intval($row['hits']);
                
                echo 
"<div class='small'>&nbsp;&nbsp;- <a href='index.php?page=guide&op=readGuide&id=$id&title=".mem_urlencode($nome)."' title='$nome'>$nome</a></div>\n";
            }
            
            
//Pages
            
include_once("inc/class/paginationSystem.class.php");
            
$ps = new paginationSystem();
            
$ps->items $ofsppg;
            
$ps->actpg $pg;
            
$ps->query "SELECT id FROM memht_guide WHERE argomento=$ida";
            
$ps->url "index.php?page=guide&op=arg&id=$ida&title=".mem_urlencode($title)."&pg={{N}}";
            
$ps->show();
        } else {
            echo 
"<div align='center' id='errorText' colspan='2'><b>"._NOGUIDESINSEC_."</b></div>\n";
        }
    
closeTable();
}

function 
viewGuide($id,$title,$pg=1) {
    global 
$dblink,$siteConfig,$admin,$user;

    
$idg intval($id);
    
$ipg $pg 1;
    
    if (
$row $dblink->get_row("SELECT g.*,(SELECT ROUND(SUM(r.vote)/COUNT(r.id)) AS irank FROM memht_ratings AS r WHERE whr=2 AND r.wid=g.id) AS rank,DATE_FORMAT(g.data, '".$siteConfig['timestamp']."') as data,g.language AS languageid,l.language AS languagetxt FROM memht_guide AS g LEFT JOIN memht_content_languages AS l ON g.language = l.id WHERE g.id=$idg OR g.nome='$title' AND g.enabled=1")) {
        
$dblink->query("UPDATE memht_guide SET hits=hits+1 WHERE id=$id OR nome='$title'");
        
$id intval($row['id']);
        
$argomento intval($row['argomento']);
        
$nome outCode($row['nome']);
        
$descrizione outCode($row['descrizione']);
        
$testo outCode($row['testo']);
        
$autore outCode($row['autore']);
        
$data $row['data'];
        
$hits intval($row['hits']);
        
$usecomments intval($row['usecomments']);
        
$rank intval($row['rank']);
        
$languageid intval($row['languageid']);
        
$languagetxt outCode($row['languagetxt']);
        
        if (
$languageid==0) { $languagetxt _GLOBAL_; }
        
        if (
$descrizione!="") { $testo "<div class='info'>$descrizione</div><br>$testo"; }
        
$testo explode("[-pagebreak-]",$testo);
        
$mytext trim($testo[$ipg]);
        
        if (
memRunHooks('ViewGuide',array($id,$argomento,$nome,$descrizione,$mytext,$autore,$data,$hits,$rank))) {
            
openTable();
                
//Content head
                
include_once("inc/class/conthead.class.php");
                
$ch = new conthead();
                
$ch->title $nome;
                
$ch->cdate $data;
                
$ch->author $autore;
                
$ch->hits $hits;
                
$ch->langid $languageid;
                
$ch->langtxt $languagetxt;
                
$ch->prnt_url "pages/guide/print.php?id=$id";
                
$ch->pdf_url "pages/guide/pdf.php?id=$id";
                
$ch->rss_url "rss.php?page=guide&topic=$argomento";
                
$ch->url $siteConfig['site_url']."/index.php?page=guide&op=readGuide&id=$id&title=".mem_urlencode($nome);
                
$ch->show();
                
                echo 
"<div style='padding:20px 0; clear:left;'>$mytext</div>\n";
                
                
//Rating
                
include_once("inc/class/rating.class.php");
                
$rt = new rating();
                
$rt->whr 2;
                
$rt->wid $id;
                
$rt->rank $rank;
                
$rt->show();
                
                
//Tags
                
include_once("inc/class/tags.class.php");
                
$tg = new tags();
                
$tg->whr 2;
                
$tg->wid $id;
                
$tg->show();
            
closeTable();
            
            
memRunHooks('ViewGuideEnd',array($id,$argomento,$nome,$descrizione,$mytext,$autore,$data,$hits,$rank));
        }
        
        if (
sizeof($testo)>1) {
            
openTable();
                
//Pages
                
include_once("inc/class/paginationSystem.class.php");
                
$ps = new paginationSystem();
                
$ps->items 1;
                
$ps->actpg $pg;
                
$ps->override_query true;
                
$ps->tot_items sizeof($testo);
                
$ps->url "index.php?page=guide&op=readGuide&id=$id&title=".mem_urlencode($nome)."&pg={{N}}";
                
$ps->show();
                
                echo 
"<div align='center' style='margin:6px;'>";
                    
showBanner(5);
                echo 
"</div>";
            
closeTable();
        }
        if (
$siteConfig['usecomments']==AND $usecomments==1) {
            
openTable();
                
//Comments
                
include_once("inc/class/comments.class.php");
                
$cc = new comments();
                
$cc->whr 2;
                
$cc->wid $id;
                
$cc->show();
            
closeTable();
        }
    } else {
        
openTable();
            echo 
"<div align='center' id='errorText'><b>"._GUIDONOTEXISTS_."</b></div>";
        
closeTable();
    }
}

    switch(
$op) {
        case 
"arg":
            
viewArgument($id,$title,$ofsbgn,$ofsppg,$pg);
        break;
    
        case 
"readGuide":
            
viewGuide($id,$title,$pg);
        break;
        
        default:
            
guideList();
        break;
    }

?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0121 ]--