!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis/ums/   drwxr-xr-x
Free 51.22 GB of 127.8 GB (40.08%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     umShowUser-nosearch.php (3.04 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?
include_once("pagebody.php");
pageHeader();
$pageTitle="รายชื่อผู้ใช้";
?>
<table width=100% class="pageTitleBgColor" align="center">
<tr><td align=center><? echo $pageTitle?></td></tr>
</table>
<!--your code here-------------------------------------------------------------------------->
<br>
<?
include_once("clsUmUser.php");
include_once(
"clsUmGroup.php");
$oC = new clsConnection($GLOBALS['HOST'], $GLOBALS['DB'], $GLOBALS['USER'], $GLOBALS['PASSWORD']);
$oUs = new umuser($oC);
$oGp = new umGroup($oC);

$oGp->RSumgroup();
$aGp = array();
while(
$oGp->GetRecord()){
    
$aGp += array($oGp->GpID=>$oGp->GpNameT);
}
$oGp->Close();

//$oUs->SearchByLogin("admin","nimda");
$oUs->RSumuser();

//set num row per page
if($nrpp=="")
    
$oUs->rowPerPage=10;
else 
    
$oUs->rowPerPage=$nrpp;
if (
$pg==""$pg=1;
$oUs->gotoPage($pg);

//$oTbl = new clsTable(array("ลำดับ","ชื่อล๊อกอิน","ชื่อ-สกุล","ตำแหน่ง","เข้าใช้ระบบครั้งสุดท้าย","ดำเนินการ"));
$oTbl = new clsTable(array("ID","ชื่อล๊อกอิน","ชื่อ-สกุล","ตำแหน่ง","ดำเนินการ"));
$oTbl->align="center";
$i=$oUs->frRowNum+1;
while (
$oUs->GetRecord()){
    
$oTbl->rowStart($i%2);
    
$oTbl->addCell($oUs->UsID ,"center");
    
$oTbl->addCell($oUs->UsLogin);
    
$oTbl->addCell($oUs->name);
    
$oTbl->addCell($oUs->posName);
    
//$oTbl->addCell("เข้าระบบ");
    
$s="<a href=\"umEditUser.php?UsID=" $oUs->UsID "\"><img src=\"images/edit.gif\" alt=\"แก้ไข\"  border=\"0\"></a>
        <a href='#'  onClick=\"doDelete(document.form1, '$oUs->UsLogin', $oUs->UsID)\" ><img src=\"images/del.gif\" alt=\"ลบ\"  border=\"0\"></a>
        <a href=\"umShowMenu.php\"><img src=\""
;
    if (
$oUs->UsActive==1
        
$s.="images/useractive.png\" ";
    else 
        
$s.="images/userlock.gif\" ";
    
$s.="alt=\"set/unset active\"  border=\"0\"></a>
            <a href=\"umPermission.php?UsID=" 
$oUs->UsID "\"><img src=\"images/menu.gif\" alt=\"กำหนดสิทธิ์การใช้รายคน\"  border=\"0\"></a>";
    
$oTbl->addCell($s,"center");
     
$oTbl->rowEnd();
     
$i++;
}

$oTbl->rowStart(0,$oTbl->footerBgColor);
$oTbl->addCell("&nbsp;","","",4);
$oTbl->addCell("<a href=\"umAddUser.php\">
                <img src=\"images/new.gif\" alt=\"เพิ่มระบบงาน\" border=\"0\"></a>"
,"center");
$oTbl->rowEnd();
$oTbl->rowStart();
$s="";
$mxPage=$oUs->numPages();
for (
$i=1$i<=$mxPage$i++){
    
$s.="<a href=umShowUser.php?pg=$i&nrpp=$nrpp>$i</a> ";
    if (
$i 30 ==0$s.="<br>";
}
$oTbl->addCell($s,"center","",5);
$oTbl->rowEnd();
echo 
$oTbl->output();

//echo "<tr class=TableFooterBgColor>";
//echo "<td colspan=\"4\">&nbsp;</td>";
//echo "<td colspan=\"4\" align=\"center\"><a href=\"umAddSystem.php\"><img src=\"images/new.gif\" alt=\"เพิ่มระบบงาน\" border=\"0\"></a></td>";
//echo "</tr>";

////////////////////////
?>
</br>
<!--------------------------------------------------------------------->
<? 
$oUs
->Close();
pageFooter(); 
?>
<!--------------------------------------------------------------------->
<!--put javascript here-->
<script language="javascript">
function doDelete(f,txt,ID){
    if (confirm('ต้องการลบผู้ใช้ ' + ID + ':' + txt +  ' ใช่หรือไม่') ) {
        window.location="processUmUser.php?method=delete&UsID=" +ID;
    }
}

//document.form1.login.focus();
</script>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0158 ]--