!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis/application/controllers/eregis-12022565/   drwxrwxrwx
Free 50.66 GB of 127.8 GB (39.64%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     rpt_misc_1.php (6.68 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
include('rg_controller.php');
class 
rpt_misc extends Rg_controller {

//    function __construct() {
//        parent::__construct();
//    }
    
    
public function show_repRis111($method="") {
        
$this->load->model($this->config->item("rg_folder").'mo_rg_term','tm');
        
$this->contents['rs_tm'] = $this->tm->get_options("");
        
$this->contents['acY'] = $this->session->userdata('acY');
        
$this->contents['tmId'] = $this->session->userdata('tmId');
        
$this->contents['method'] = $method;

        
$this->output($this->config->item("rg_folder")."v_searchRepRis111");
    }

    public function 
search_repRis111() {
        
$this->load->library('form_validation');
        
$this->form_validation->set_error_delimiters('<font color="red">','</font>');

        
$this->form_validation->set_rules('acY''ปีการศึกษา''trim|required|xss_clean|max_length[4]');
        
$this->form_validation->set_rules('tmId''ภาคการศึกษา''trim|required|xss_clean');
        
$this->form_validation->set_rules('crsCode''รหัสรายวิชา''trim|required|xss_clean|max_length[10]');

        if (
$this->form_validation->run() == TRUE) {
            
$acY $this->input->post('acY');
            
$tmId $this->input->post('tmId');
            
$crsCode $this->input->post('crsCode');

            
$this->load->model($this->config->item("rg_folder").'mo_rg_courseopen','co');
            
$this->load->model($this->config->item("rg_folder").'mo_rg_timetable','tt');

            
$this->contents['acY'] = $acY;
            
$this->contents['tmId'] = $tmId;
            
$this->contents['crsCode'] = $crsCode;
            
            
$arr = array();
            
$exp = array('crsCode' => $crsCode,
                         
'coAcY' => $acY,
                         
'coTmId' => $tmId);

            
//---- หาจำนวนรายวิชาที่ต้องการ จัดกลุ่มตาม crsId
            
$rs_gco $this->co->qryCoGroupCrs($exp);

            foreach(
$rs_gco->result() as $gco) {
                
$arr[$gco->crsId] = array('coId' => $gco->coId,
                                        
'crsCode' => $gco->crsCode,
                                        
'coCrsId' => $gco->crsId,
                                        
'crsName' => $gco->crsName);

                
$exp1 = array('crsId' => $gco->crsId,
                              
'coAcY' => $acY,
                              
'coTmId' => $tmId);
                
$rs_gcur $this->co->qryCoGroupCur($exp1);
    
                
$i 1;
                foreach(
$rs_gcur->result() as $gcur) {
                    
$rs_prs $this->tt->qryTeacher($gcur->coId);
                    
$row_rs_prs $rs_prs->row();

                    
$arr[$gco->crsId]['cur'.$i] = array('curId' => $gcur->curId,
                                                          
'curName' => $gcur->curName,
                                                          
'coSectionClass' => $gcur->coSectionClass,
                                                          
'prsName' => $row_rs_prs->prsName);
                    
$i++;
                }
            }
            
            
$this->contents['arr'] = $arr;
            
$this->output($this->config->item("rg_folder")."v_showRepRis111");        
        } else {
            
$this->show_repRis111("add");
        }    
    }

    function 
repRis111($acY$tmId$coId) {
        echo 
"<br />".$acY;
        echo 
"<br />".$tmId;
        echo 
"<br />".$coId;
        echo 
"หวัดดีจ๊ะ";

        
$this->load->model($this->config->item("rg_folder").'mo_rg_courseopen','co');
        
//$exp = array('c')
        
$rs_cur $this->co->qryCoGroupCur($exp);

        
//$this->output_pdf($this->config->item("rg_folder")."v_repRis111");
    
}

    function 
qq() {
        
$index 1;

        echo 
"หิววุ้ย";

        
$arr[$index] = array('f1' => "ข้าวผัด",
                             
'f2' => "กระเพาะปลา",
                             
'f3' => "ต้มจืด");

        for(
$i=1$i <= 3$i++) {
            
$arr[$index]["dessert".$i] = array('d1' => "แตงโม");
        }
        echo 
"<pre>";
        echo 
print_r($arr);
        echo 
"</pre>";

        
$this->contents['arr'] = $arr;
        
$this->output($this->config->item("rg_folder")."qqshow");
    }

    public function 
search_stdInCo111($coId$crsSection$acY$tmId) {
        
$this->load->model($this->config->item("rg_folder").'mo_rg_registdetails','rd');

        
$this->contents['rs_std'] = $this->rd->qryStdRegist($coId$crsSection$acY$tmId);
        
//var_dump($rs_std);

        
$this->output_pdf($this->config->item("rg_folder")."v_repRis111");    
    }

    public function 
show_repRis112() {
        
$this->load->model($this->config->item("rg_folder").'mo_rg_term','tm');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_curriculum','cur');

        
$exp = array('curStatus' => 'Y');
        
$this->contents['rs_tm'] = $this->tm->get_options("");
        
$this->contents['rs_cur'] = $this->cur->get_options($exp);
        
$this->contents['acY'] = $this->session->userdata('acY');
        
$this->contents['tmId'] = $this->session->userdata('tmId');

        
$this->output($this->config->item("rg_folder")."v_searchRepRis112");
    }

    public function 
search_repRis112() {
        
//$this->load->library('form_validation');
        //$this->form_validation->set_error_delimiters('<font color="red">','</font>');

        //$this->form_validation->set_rules('acY', 'ปีการศึกษา', 'trim|required|xss_clean|max_length[4]');
        //$this->form_validation->set_rules('tmId', 'ภาคการศึกษา', 'trim|required|xss_clean');

    
        /*if ($this->form_validation->run() == TRUE) {
            $tmId = $this->input->post('tmId');
            $acY = $this->input->post('acY');
            $curId = $this->input->post('curId');
            $stdCode = $this->input->post('stdCode');

            //if($stdCode != NULL) {
                //$this->load->model($this->config->item("rg_folder").'mo_rg_student','std');
                //$rs_std = qryCoRegist($acY, $tmId, $stdCode);*/

            
$this->output_pdf($this->config->item("rg_folder")."v_repRis112");
            
//}
        //} else {
        //    $this->show_repRis112("add");
        //}
    
}


    
/*|-----------------------------------------------------------------------------------|
      |                                                                                      |
      |                        ก่อนหน้านี้เป็นการเขียนฟังก์ชั้นตาม sequence                  |
      |                                                                                      |    
      |-----------------------------------------------------------------------------------|*/

    /*
    public function searchRptRis111() {

        return;
    }


    public function showRptRis111() {

        return;
    }


    public function rptRis111() {

        return;
    }


    public function searchRptRis112() {

        return;
    }


    public function rptRis112() {

        return;
    }


    public function searchRptRis113() {

        return;
    }


    public function rptRis113() {

        return;
    }


    public function searchRptRis119() {

        return;
    }


    public function rptRis119() {

        return;
    }


    public function curAndAdmitYAndGenStatusIsYTable() {

        return;
    }


    public function searchRptRis123() {

        return;
    }


    public function rptRis123() {

        return;
    }


    public function curAndAdmitYAndGenStatusIsYTable() {

        return;
    }


    public function searchRptRis124() {

        return;
    }


    public function rptRis124() {

        return;
    }


    public function curAndAdmitYAndGenStatusIsYTable() {

        return;
    }


    public function searchRptRis125() {

        return;
    }


    public function rptRis125Cur() {

        return;
    }


    public function rptRis125() {

        return;
    }


    public function searchRptRis202() {

        return;
    }


    public function rptRis202() {

        return;
    } */


}
?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0166 ]--