!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/manage/include/   drwxr-xr-x
Free 52.64 GB of 127.8 GB (41.19%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     Function.php (7.14 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |

$ThaiMonth[$i]\n ";
		else
			echo"\n\t\n ";*/
		echo"\n\t\n ";		
	}
}


/////////////////////////////////////////////////////////////////////////////////
function getThaiSubMonth( $a )
{
	global $ThaiSubMonth;
	
	$a  = $a -1;
	for( $i=0; $i<=11; $i++ )
	{
		if( $a == $i )
			return $a = $ThaiSubMonth[$i];
	}
}

/////////////////////////////  Display  Thai Month ////////////////////////////////////////////////////////////////////////
function getDay1to31()
{
	for( $i=1; $i<=31; $i++ )
	{  
		/*if( $i == 1 )
			echo"\n\t\n ";
		else
			echo"\n\t\n ";*/
		echo"\n\t\n ";
	}
}


///////////////////   Display  Thai  Year ////////////////////////////////////////////////////////////////////
function get2Year()
{
	$today = getdate();
	$year = $today[year];
	
	for( $x=$year-50; $x<=2010; $x++ )
	{
		$z = $x+547;
		if( $x == ($year+10) )
			echo"\n\t\n ";
		else
			echo"\n\t\n "; 
	}
}


///////////////////   Display  Year  ////////////////////////////////////////////////////////////////////
function getYear( $year )
{
	return $year = ( $year + 543 );  
}


///////////////////////////// Display Degree 
function getThaiDegree()
{
	global $ThaiMonth;
	
	for( $i=0; $i<=2; $i++ )
	{
		$a = $i+1;
	    if( $a == 1 )
			echo"\n\t\n ";
		else
			echo"\n\t\n ";
	}
}


//////////////////////////////////////////
function TxtThaiMonth( $a )
{
	global $ThaiMonth;
	
	$a  = $a -1;
	for( $i=0; $i<=11; $i++ )
	{
		if( $a == $i )
			return $a = $ThaiMonth[$i];
	}
}


//////////////////* ฟังก์ชั่นตรวจสอบความยาวของสตริง เช่น CheckLenght( $mPassword, 6 ) */
function CheckLenght( $txt , $width )
{
	if( strlen( $txt ) >= $width )
		return true;
	return false;
}
	
	
//////////////////////////////* ฟังก์ชั่นตรวจสอบรูปแบบของ Email Address */
function validEmail ( $email ) 
{ 
	if ( ! eregi( "^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+([\.][a-z0-9-]+)+$", $email ) )
		return false;
	return true;
}
	
	
////////////////* ฟังก์ชั่นตรวจสอบข้อมูลที่นำเข้าว่า เป็นตัวอักษรภาษาอังกฤษ กับ ตัวเลขหรือไม่ */
function CheckEngNumAlpha ( $txt ) 
{
	if ( ! ereg( "[^abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890]", $txt ) )
		return true;
}

function dmyE2ymdT($ddmmyyyy){
// 13/10/2011 ==> 2554-10-13	
	$dmy = substr($ddmmyyyy,0,10);
	$ymd = (substr($dmy,-4) + 543) . "-" . substr($dmy,3,2) . "-" . substr($dmy,0,2);	
	return $ymd;
}
	
function dmyE2dmyT($ddmmyyyy){
	// 13/10/2005  ==> 13 ตุลาคม 2548
	global $ThaiMonth;

	if ($ddmmyyyy=="")
		$dmyT=="";
	else{
		$ymdE = substr($ddmmyyyy,0,10);
		//$m = (int) substr($ymdE,3,2);
		$dmyT = ((substr($ymdE,0,2) < 10)?substr($ymdE,1,1):substr($ymdE,0,2))." ".$ThaiMonth[(substr($ymdE,3,2)-1)]." ".(substr($ymdE,-4)+543) ;
	}
	return $dmyT;
}

function ymdT2dmyE($yyyymmdd){
// 2554-10-13 ==> 13/10/2011
	if ($yyyymmdd=="")
		$ymd="";
	else{
		$ymd = substr($yyyymmdd,0,10);
		$dmy = substr($ymd,-2) . "/" .  substr($ymd,5,2) . "/" .(substr($ymd,0,4) - 543);
		//$dmy = (substr($ymd,-4) + 543) . "-" . substr($ymd,3,2) . "-" . substr($ymd,0,2);
	}
	return $dmy;
}

function dmyE2ymdE2($ddmmyyyy){ // 13/10/2011 ==> 2011-10-13
	
	list($d,$m,$y) = split('/',$ddmmyyyy);

	return $y."-".$m."-".$d;
}

function ymdE2dmyE2($yyyymmdd){ // 2011-10-13 ==> 13/10/2011
	
	list($y,$m,$d) = split('-',$yyyymmdd);

	return $d."/".$m."/".$y;
}

function citizenID_format($citizenID){ // 1234567890123 => 1-2345-67890-12-3
	if(strlen($citizenID) == 13) return substr($citizenID,0,1)."-".substr($citizenID,1,4)."-".substr($citizenID,5,5)."-".substr($citizenID,-3,2)."-".substr($citizenID,-1);
	else return $citizenID;
}

function ymdE2dmyText($yyyymmdd){ // 2012-08-02 ==> 2 สิงหาคม 2555

	list($y,$m,$d) = split('-',$yyyymmdd);
	
	return intval($d)." ".TxtThaiMonth($m)." ".($y+543);
}

function ymdE2dmySubText($yyyymmdd){ // 2012-08-02 ==> 2 ส.ค. 55

	list($y,$m,$d) = split('-',$yyyymmdd);
	
	return intval($d)." ".getThaiSubMonth($m)." ".substr(($y+543),-2);
}

function ymdT2dmyText($yyyymmdd){ // 2555-08-02 ==> 2 สิงหาคม 2555

	list($y,$m,$d) = split('-',$yyyymmdd);
	
	return intval($d)." ".TxtThaiMonth($m)." ".$y;
}

function ymdT2dmySubText($yyyymmdd){ // 2555-08-02 ==> 2 ส.ค. 55

	list($y,$m,$d) = split('-',$yyyymmdd);
	
	return intval($d)." ".getThaiSubMonth($m)." ".substr($y,-2);
}

function downloadFile($fullPath){

  // Must be fresh start
  if(headers_sent())
    die('Headers Sent');

  // Required for some browsers
  if(ini_get('zlib.output_compression'))
    ini_set('zlib.output_compression', 'Off');

  // File Exists?
  if( file_exists($fullPath)){
   
    // Parse Info / Get Extension
    $fsize = filesize($fullPath);
    $path_parts = pathinfo($fullPath);
    $ext = strtolower($path_parts["extension"]);
   
    // Determine Content Type
    switch ($ext) {
      case "txt": $ctype="application/txt"; break;
	  case "pdf": $ctype="application/pdf"; break;
      case "exe": $ctype="application/octet-stream"; break;
      case "zip": $ctype="application/zip"; break;
	  case "rar": $ctype="application/rar"; break;
      case "doc": $ctype="application/msword"; break;
      case "xls": $ctype="application/vnd.ms-excel"; break;
      case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
      case "gif": $ctype="image/gif"; break;
      case "png": $ctype="image/png"; break;
      case "jpeg": $ctype="image/jpg"; break;
      case "jpg": $ctype="image/jpg"; break;
      default: $ctype="application/force-download";
    }

    header("Pragma: public"); // required
    header("Expires: 0");
    header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
    header("Cache-Control: private",false); // required for certain browsers
    header("Content-Type: $ctype");
    header("Content-Disposition: attachment; filename=\"".basename($fullPath)."\";" );
    header("Content-Transfer-Encoding: binary");
    header("Content-Length: ".$fsize);
    ob_clean();
    flush();
    readfile($fullPath);

  } else
    die('File Not Found');

}

?>
bool(false)

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0056 ]--