!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mistk/eoffice/admin/   drwxr-xr-x
Free 50.91 GB of 127.8 GB (39.84%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     processDocInboxStaff.php (4.77 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
include_once("../../class/clsConnection.php");
include_once(
"../../class/clsDB.php");
include_once 
"../global.php";
include_once 
"../class/clsDepartment.php";
include_once 
"../link/function.php";
include_once 
"../link/functionshow.php";
include_once 
"funct.php";
include_once 
"../class/clsDocInboxStaff.php";

$oC = new clsConnection($GLOBALS['DBHOST'], $GLOBALS['DBNAME_EOFFICE'], $GLOBALS['DBUSER_EOFFICE'], $GLOBALS['DBPASS_EOFFICE']);

$oDP = new Department($oC);
$oDP2 = new Department($oC);
$oDP3 = new Department($oC);
$oDP4 = new Department($oC);
$oDP5 = new Department($oC);
$oDbxS = new DocInboxStaff($oC);
$oDbxS1 = new DocInboxStaff($oC);
$oDbxS2 = new DocInboxStaff($oC);

$MaxDocGroup=$oDP->SearchMaxDocGroup();
if(
$method=="addfolder"){  
        
$oDbxS->SearchByInboxNamenotdel($dlcid,$dlpid,$deptId,$docGroup,$foldernew);
        if(
$oDbxS->GetRecord()=="1"){
        
?>
            <script>window.alert("ª×èÍâ¿Åà´ÍÃì¹ÕéÁÕÍÂÙèáÅéÇ ¡ÃسÒãªéª×èÍâ¿Åà´ÍÃìãËÁè");</script>
            <form  METHOD="POST" action="manageFolderStaff.php">
            <input type="hidden" name="foldernew"  id="foldernew"  value="<? echo $foldernew?>">
            <input type="hidden" name="addline" id="addline"  value="<? echo $addline?>">
            </form>                
        <?
            
echo "<body onload=\"document.forms[0].submit();\">";
        }else{  
            
$oDbxS->AddNew();
            
$oDbxS->DocInboxSID=$oDbxS->GetNextCode();
            
$oDbxS->DlcID=$dlcid;
            
$oDbxS->deptId=$deptId;
            
$oDbxS->DlpID=$dlpid;
            
$oDbxS->InboxName=$foldernew;
            
$oDbxS->InboxDel=0;
            
$oDbxS->seqBox=$oDbxS1->SearchseqNext($dlcid,$dlpid,$deptId,$docGroup);
            
$oDbxS->docGroup=$docGroup;
            
$oDbxS->Save();
            echo 
"<meta http-equiv='refresh' content='0; URL=manageFolderStaff.php'>";
        }
        
}else if(
$method=="renamefolder"){ 
        
$oDbxS->SearchByInboxNamenotdel($dlcid,$dlpid,$deptId,$docGroup,$editfolder);
        if((
$oDbxS->GetRecord()=="1") && ($oldvalue!=$editfolder)){
        
?>
            <script>window.alert("ª×èÍâ¿Åà´ÍÃì¹ÕéÁÕÍÂÙèáÅéÇ ¡ÃسÒãªéª×èÍâ¿Åà´ÍÃìãËÁè");</script>
            <form  METHOD="POST" action="manageFolderStaff.php">
            <input type="hidden" name="DocInboxSID" id="DocInboxSID" value="<? echo $iddoc?>">
            <input type="hidden" name="addname" id="addname"  value="<? echo $addname?>">
            </form>                
        <?
            
echo "<body onload=\"document.forms[0].submit();\">";
        }else{
            
$oDbxS->SearchByKey($iddoc); 
            
$oDbxS->GetRecord();
            
$oDbxS->Edit();
            
$oDbxS->InboxName=$editfolder;
            
$oDbxS->Save();
            echo 
"<meta http-equiv='refresh' content='0; URL=manageFolderStaff.php'>";
        }
}else if(
$method=="delfolder"){ 
            
$flagCommit true;
            
$checkflagCommittrue;
            
$oC->BeginTrans(); 
            
            
$oDbxS->SearchByKey($iddoc); 
            
$oDbxS->GetRecord();
            
$oDbxS->Edit();
            
$oDbxS->InboxDel="Y";
            
$checkflagCommit $oDbxS->Save();
            if(!
$checkflagCommit){ $flagCommit=$checkflagCommit;   }
            
/*
            if($countdocfolder>0){
                    $oRs->SearchByPersonIdDrsDeleteDrsflagReadDrsInboxID($personId,$iddoc);
                    while($oRs->GetRecord()){
                        $oRs->Edit();
                        $oRs->DrsDelete="Y";    
                        $checkflagCommit = $oRs->Save();
                        if(!$checkflagCommit){ $flagCommit=$checkflagCommit;   }
                    }
                    
            }
            */
    
if($flagCommit)
        
$oC->CommitTrans();
    else
        
$oC->RollbackTrans();
                
            echo 
"<meta http-equiv='refresh' content='0; URL=manageFolderStaff.php'>";
}else if(
$method=="changeSeq"){ 
    
$flagCommit true;
    
$oC->BeginTrans();
    
    if(
$typeb=="Top"){
        
$oDbxS->SearchByNoDelFolderlimitPreSeq($dlcid,$dlpid,$deptId,$docGroup,$seqBox); 
        
$oDbxS->GetRecord();
        
        
$preboxID=$oDbxS->DocInboxSID;
        
$preseqBox=$oDbxS->seqBox;
        
        
$thisboxID=$DocInboxSID;
        
$thisseqBox=$seqBox;
        
            
$oDbxS1->SearchByKey($preboxID); 
            
$oDbxS1->GetRecord();
            
$oDbxS1->Edit();
            
$oDbxS1->seqBox=$thisseqBox;
            
//echo "seqBox1=".$oDbx1->seqBox."<br>";
            
$flagCommit $oDbxS1->Save();
            
            
$oDbxS2->SearchByKey($thisboxID); 
            
$oDbxS2->GetRecord();
            
$oDbxS2->Edit();
            
$oDbxS2->seqBox=$preseqBox;
            
//echo "seqBox2=".$oDbx2->seqBox."<br>";
            
$flagCommit $oDbxS2->Save();
            
            if(
$flagCommit)
                
$oC->CommitTrans();
            else
                
$oC->RollbackTrans();
        
        
    }else if(
$typeb=="Bottom"){
        
$oDbxS->SearchByNoDelFolderlimitNextSeq($dlcid,$dlpid,$deptId,$docGroup,$seqBox);  
        
$oDbxS->GetRecord();

        
$nextboxID=$oDbxS->DocInboxSID;
        
$nextseqBox=$oDbxS->seqBox;
        
        
$thisboxID=$DocInboxSID;
        
$thisseqBox=$seqBox;
        
            
$oDbxS1->SearchByKey($nextboxID); 
            
$oDbxS1->GetRecord();
            
$oDbxS1->Edit();
            
$oDbxS1->seqBox=$thisseqBox;
            
//echo "seqBox1=".$oDbx1->seqBox."<br>";
            
$flagCommit $oDbxS1->Save();
            
            
$oDbxS2->SearchByKey($thisboxID); 
            
$oDbxS2->GetRecord();
            
$oDbxS2->Edit();
            
$oDbxS2->seqBox=$nextseqBox;
            
//echo "seqBox2=".$oDbx2->seqBox."<br>";
            
$flagCommit $oDbxS2->Save();
            
            if(
$flagCommit)
                
$oC->CommitTrans();
            else
                
$oC->RollbackTrans();        
        
    }
    echo 
"<meta http-equiv='refresh' content='0; URL=manageFolderStaff.php'>";
    
}
?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0067 ]--