!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/manage/directorBCNU/   drwxr-xr-x
Free 52.6 GB of 127.8 GB (41.16%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     CarBymont.php (7.81 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
  
  session_start();
	
	/**  Define Validate Access  */
	define( '_VALID_ACCESS', 1 );

	/**  Check Session User Login  */
	if( !session_is_registered("valid_user") && !session_is_registered("Priority") ) {
		echo "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=windows-874\" />";
		echo "<p style=padding-top:115px><p align=center><br /><font color=red><strong>กรุณาทำการ Login ก่อน</strong></font></p></p>";
		echo "<meta http-equiv=\"refresh\" content=\"1; URL=../login.php\" />";
		exit();
	} 
	else {
		/**  Configuration  */
		require_once( "../configuration.php" );
		require_once( $_Config_absolute_path . "/includes/framework.php" );
	    require_once( "../include/Function.php" );
	    require_once( "../calendar/check.php" );
		require_once( "../calendar/cal_func.php" );
		require_once( "../link/function.php" );
		/**  Create Database Object  */
		$dbObj = new DBConn;
		
		/**  Config Table for This Page  */
		$myTable = "personal_tb";
		
		$Username = $valid_user;


		
$sql = " SELECT   DateCar,Date_start, Date_finish  from formcaroffice ";
$rsCal = mysql_query($sql) or die(" Error").mysql_error();
$row = mysql_fetch_array($rsCal);	
 
	} # else	
		
 ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-874" />
<link href="../css/calendar.css" rel="stylesheet" type="text/css" />
<link href="../css/default.css" rel="stylesheet" type="text/css" />
<script language="javascript" src="../js/utilities.js"></script>
<title>ยินดีต้อนรับ - การขอใช้รถยนต์</title>

</head>

<body topmargin="0" rightmargin="0" bottommargin="0" leftmargin="0">
<?php
	include("../templates/incHeader.php");
?>
<table width="1003" border="0" cellspacing="0" cellpadding="0">
  <tr>
    <td width="203" align="left" valign="top" style="padding:10px 0px 0px 5px"><?php include("./_incMainMenu.php");?></td>
    <td width="800" height="440" align="left" valign="top" style="padding:10px 0px 5px 10px"><fieldset>
    <legend><font size="2" color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>"><a href="index.php">หน้าหลัก</a></font><img src="../picture/ico3.gif" width="10" height="10" align="absmiddle" border="0" /></font><span class="NOTE">ปฏิทินการขอใช้รถยนต์ราชการ</a></font></span></legend>
      <table width="780" border="0" cellspacing="0" cellpadding="0">
      <tr>
        <td height="5"></td>
      </tr>
      
      <tr>
        <td align="center">&nbsp;</td>
      </tr>
      <tr>
        <td><span class="PADDING-TOP-10"><img src="../images/icons/arrow-circle-225-left.png" width="16" height="16" border="0" align="absmiddle" /> <a href="javascript:;" onclick="window.history.back();"><strong>&lsaquo; ย้อนกลับ</strong></a></span></td>
      </tr>
      <tr>
        <td height="370" align="center" valign="top"><table width="448" height="279" border="0" cellpadding="0" cellspacing="0">
          <tr>
            <th width="28" height="28" scope="col">&nbsp;</th>
            <th width="391" align="center" scope="col">&nbsp;</th>
            <th width="15" scope="col">&nbsp;</th>
          </tr>
          <tr>
            <td height="28">&nbsp;</td>
            <td><table width="101%" height="31" border="0" cellpadding="1" cellspacing="1">
              <tr bgcolor="#004080" class="title">
                <td width="13%" height="29" align="center" bgcolor="#FF9999" class="title" ><a href="<?php echo "$PHP_SELF?Y=$cal_prev_year&m=$cal_prev_month&d=$cal_day" ?>">&lt;&lt;</a></td>
                <td width="73%" align="center" bgcolor="#FF9999"><font face="Tahoma"><?php echo $_month_name[$cal_month]." ปี พ.ศ ".($cal_year+543);?></font></td>
                <td width="14%" align="center" bgcolor="#FF9999" class="title"><a href="<?php echo "$PHP_SELF?Y=".$cal_next_year."&m=".$cal_next_month."&d=".$cal_day;?>">&gt;&gt;</a></td>
                </tr>
              </table></td>
            <td>&nbsp;</td>
          </tr>
          <tr>
            <td height="163">&nbsp;</td>
            <td><table width="101%" height="193" border="0" cellpadding="1" cellspacing="1" class="overview" >
              <tr>
                <td height="25" align="center" bgcolor="#CC66FF" class="dayname">จันทร์</td>
                <td width="16%" align="center" bgcolor="#CC66FF" class="dayname">อังคาร</td>
                <td width="13%" align="center" bgcolor="#CC66FF" class="dayname">พุธ</td>
                <td width="17%" align="center" bgcolor="#CC66FF" class="dayname">พฤหัสบดี</td>
                <td width="13%" align="center" bgcolor="#CC66FF" class="dayname">ศุกร์</td>
                <td width="14%" align="center" bgcolor="#CC66FF" class="dayname">เสาร์</td>
                <td width="14%" align="center" bgcolor="#CC66FF" class="dayname">อาทิตย์</td>
              </tr>
              <?php

//เอาวันเริ่มและสิ้นสุดมาเก็บใน array เพื่อใช้ในการเปรียบเทียบ

$st=array();$ed=array();

$i=0;

do{

$st[$i]=$row['DateCar'];

$ed[$i]=$row['DateCar'];

 $i++;} 
 while ($row =  mysql_fetch_array($rsCal)); 


for($i=0;$i<count($st);$i++)

{

 $ed[$i]=substr($ed[$i],0,4).substr($ed[$i],5,2).substr($ed[$i],8,2);

 $st[$i]=substr($st[$i],0,4).substr($st[$i],5,2).substr($st[$i],8,2);

}



	if ( ( $cal_year == $cur_year ) && ( $cal_month == $cur_month ) )

	{

		$today_day = $cur_day;

	} else $today_day = 0;

	//จำนวนวันในเดือนที่แล้ว จำนวนวันในเดือนนี้  หาค่าวันที่ 1 ของเดือนแบบสัปดาห์

	$days_last_month = num_days( $cal_prev_year, $cal_prev_month );

	$days_this_month = num_days( $cal_year, $cal_month );

	$first_day_pos = date( "w", mktime( 0,0,0,$cal_month,1,$cal_year) );

	//เปลี่ยนค่าที่ได้ถ้าเป็นวันอาทิตย์ให้เท่ากับ 7 แทน Mo=1 to Su=7

	if ( $first_day_pos == 0 ) $first_day_pos = 7; 

	

	$day_num= $days_last_month - ($first_day_pos-2); 

	$class="last_month";

	$p=array();

	

	for ( $y=1; $y<=6; $y++ )

	{

		echo "<tr>";

		for ( $x=1; $x<=7; $x++ )

		{

			if ( ($y==1) && ($x==$first_day_pos) ) 

			{ 

				$day_num = 1; $class="";

			}

			if ( ($y >1) && ($day_num>$days_this_month) ) 

			{ 

				$day_num = 1; $class="next_month"; 

			}

			if ( ($class=="") && ($day_num == $today_day) )

			{

				$id="today";

			} else $id="";

			if ( $class == "" ){ 

			if($cal_month<=9)

			$mm="0".$cal_month;

			else $mm=$cal_month;

			

			if($day_num<=9)

			$dd="0".$day_num;

			else $dd=$day_num;

			$times=$cal_year."-".$mm."-".$dd;

			}

			$cur_day=$cal_year.$mm.$dd;

			for($i=0;$i<count($st);$i++){

			if(($cur_day>=$st[$i])&&($cur_day<=$ed[$i])){

			$p[$day_num]=1;

			}

			}

			if($p[$day_num]==1&&$class==""){

			?>

			<td width="13%" align="center"  bgcolor=#FFCC99 class="<? echo $class; ?>" id="<? echo $id; ?>"> <a href="#" onClick="MM_openBrWindow('Carcalendar.php?now_stamp=<? echo $times; ?>','','scrollbars=yes,width=550,height=550')"><? echo $day_num; ?></a></td><?

			}else{ echo "<td class='".$class."' id='".$id."' bgcolor=#E9E9E9><div align='center'>".$day_num."</div></td>";

			}

			$day_num++;								

			}

		echo "</tr>";

	} 

?>
              </tr>
            </table></td>
            <td>&nbsp;</td>
          </tr>
          <tr>
            <td>&nbsp;</td>
            <td>            </td>
            <td>&nbsp;</td>
          </tr>
        </table></td>
      </tr>
      <tr>
        <td align="center" valign="top">&nbsp;</td>
      </tr>
    </table>
   </fieldset></td>
  </tr>
</table>
<?php include("../templates/incFooter.php"); ?>
</body>
</html>
<?php
	/**  Free Resource */
	$dbObj->freeresult($result);
	
	/**  Close the Database  */
	$dbObj->disconn();
	
	/**  Unset Class  */
	unset($dbObj);
?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0056 ]--