!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mistk/eoffice/admin/   drwxr-xr-x
Free 52.23 GB of 127.8 GB (40.87%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     showSendDocMobile.php (15.8 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
require_once "../../info/infosys_global.php";
require_once 
"${_MOD_PATH}mod_tplutils.php";

require_once 
"${_CLASS_PATH}clsConnection.php";
require_once 
"${_CLASS_PATH}clsDB.php";
require_once 
"${_UMS_PATH}clsUser.php";

include_once(
"../global.php");
include_once 
"../class/clsTable.php";
include_once 
"../class/clsDepartment.php";
include_once 
"../class/clsPerson.php";
include_once 
"../link/function.php";
include_once 
"../link/functionshow.php";
include_once 
"../class/clsDocLinePosition.php";
include_once 
"../class/clsDocLineConfig.php";
include_once 
"../class/clsReceiveSendType.php";
include_once 
"../class/clsDocType.php";
include_once 
"../class/clsDocSpeedLevel.php";
include_once 
"../class/clsDocSecreLevel.php";
include_once 
"../class/clsDocattatchesTmp.php";
include_once 
"../class/clsDocuments.php";
include_once 
"../class/clsDocattatches.php";
include_once 
"../class/clsDocReceiveSend.php";
include_once 
"../class/clsProposeType.php";
include_once 
"functMobile.php";
include_once 
"../class/clsDocSendtoPsTmp.php";
include_once 
"../class/clsannounceDocType.php";
include_once 
"../class/clsannounceDocType.php";
include_once 
"../class/clspsdept.php";
include_once 
"../class/clsDocWSign.php";
include_once 
"getPrefix.php";
include_once 
"../class/clsSysConfig.php";
include_once 
"../class/clsDocInboxStaff.php";

$oC = new clsConnection($GLOBALS['DBHOST'], $GLOBALS['DBNAME_EOFFICE'], $GLOBALS['DBUSER_EOFFICE'], $GLOBALS['DBPASS_EOFFICE']);

$oDP = new Department($oC);
$oDP2 = new Department($oC);
$oDP3 = new Department($oC);
$oDP4 = new Department($oC);
$oDP5 = new Department($oC);
$oDPt = new Department($oC);
$oDPt2 = new Department($oC);
$oDPt3 = new Department($oC);
$oDPt4 = new Department($oC);
$oPS = new person($oC);
$oPS2 = new person($oC);
$oPS3 = new person($oC);
$oPS4 = new person($oC);
$oPS5 = new person($oC);
$oPS6 = new person($oC);
$oPS7 = new person($oC);
//$oUG = new umgroup($oCu);
$oDlc = new DocLineConfig($oC);
$oDlc2 = new DocLineConfig($oC);
$oDlc3 = new DocLineConfig($oC);
$oDlc4 = new DocLineConfig($oC);
$oDlc5 = new DocLineConfig($oC);
$oDlc6 = new DocLineConfig($oC);
$oDlc7 = new DocLineConfig($oC);
$oDlp = new docLinePosition($oC);
$oDlp1 = new docLinePosition($oC);
$oDlp2= new docLinePosition($oC);
$oRSt = new receiveSendType($oC);
$oDt = new doctype($oC);
$oDsl = new DocSpeedLevel($oC);
$oDcl = new DocSecretLevel($oC);
$oDtmp = new DocattatchesTmp($oC);
$oDoc = new Documents($oC);
$oDoc2 = new Documents($oC);
$oDoc3 = new Documents($oC);
$oDoc4 = new Documents($oC);
$oDoc5 = new Documents($oC);
$oDatt = new Docattatches($oC);
$oRs = new DocReceiveSend($oC);
$oRs1 = new DocReceiveSend($oC);
$oRs2 = new DocReceiveSend($oC);
$oRs3 = new DocReceiveSend($oC);
$oRs4 = new DocReceiveSend($oC);
$oRs6 = new DocReceiveSend($oC);
$oRs7 = new DocReceiveSend($oC);
$oRs8 = new DocReceiveSend($oC);
$oRs9 = new DocReceiveSend($oC);
$oRs10 = new DocReceiveSend($oC);
$oRstt = new DocReceiveSend($oC);
$oPt = new ProposeType($oC);
$oStmp=new DocSendToPsTmp($oC);
$oStmp2=new DocSendToPsTmp($oC);
$oAn=new announceDocType($oC);
$oAn=new announceDocType($oC);
$oPSd = new psdept($oC);
$MaxDocGroup=$oDP->SearchMaxDocGroup();
$oDws = new docwsign($oC);
$oSys = new sysConfig($oC);
$InputThai=$oSys->SearchByInputThai();
$oDws = new docwsign($oC);
$oDbxS = new DocInboxStaff($oC);
$oDbxS1 = new DocInboxStaff($oC);
$oDbxS3 = new DocInboxStaff($oC);
$oDbxS2 = new DocInboxStaff($oC);


?>
<html>
    <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>การส่งหนังสือ</title>
    <link rel="shortcut icon" href="../source/jquery.mobile-1.4.3/favicon.ico">
    <link rel="stylesheet" href="http://fonts.googleapis.com/css?family=Open+Sans:300,400,700">
    <link rel="stylesheet" href="../source/jquery.mobile-1.4.3/css/themes/default/jquery.mobile-1.4.3.min.css">
    <link rel="stylesheet" href="../source/jquery.mobile-1.4.3/_assets/css/jqm-demos.css">
    <script src="../source/jquery.mobile-1.4.3/js/jquery.js"></script>
    <script src="../source/jquery.mobile-1.4.3/_assets/js/index.js"></script>
    <script src="../source/jquery.mobile-1.4.3/js/jquery.mobile-1.4.3.min.js"></script>
    <style>
        /*These apply across all breakpoints because they are outside of a media query */
        table.phone-compare thead th {
            background-color: #fff;
        }
        table.phone-compare thead th h4 {
            text-transform: uppercase;
            font-size: 0.6em;
            margin: 0;
        }
        table.phone-compare thead th h3 {
            font-size: .9em;
            margin: -.4em 0 .8em 0;
        }
        table.phone-compare th.label {
            text-transform: uppercase;
            font-size: 0.8em;
            opacity: 0.5;
            padding: 1em .8em;
            background-color: #ddd;
        }
        table.phone-compare tbody tr.photos td {
            background-color: #fff;
            padding: 0;
        }
        table.phone-compare tbody tr.photos img {
            max-width: 100%;
            min-width: 60px;
        }
        /*    Use the target selector to style the column chooser button */
        a[href="#phone-table-popup"] {
            margin-bottom: 1.2em;
        }
        /* Show priority 1 at 320px (20em x 16px) */
        @media screen and (min-width: 20em) {
            .phone-compare th.ui-table-priority-1,
            .phone-compare td.ui-table-priority-1 {
                display: table-cell;
            }
        }
        /* Show priority 2 at 560px (35em x 16px) */
        @media screen and (min-width: 35em) {
            .phone-compare th.ui-table-priority-2,
            .phone-compare td.ui-table-priority-2 {
                display: table-cell;
            }
        }
        /* Show priority 3 at 720px (45em x 16px) */
        @media screen and (min-width: 45em) {
            .phone-compare th.ui-table-priority-3,
            .phone-compare td.ui-table-priority-3 {
                display: table-cell;
            }
        }
        /* Manually hidden */
        .phone-compare th.ui-table-cell-hidden,
        .phone-compare td.ui-table-cell-hidden {
            display: none;
        }
        /* Manually shown */
        .phone-compare th.ui-table-cell-visible,
        .phone-compare td.ui-table-cell-visible {
            display: table-cell;
        }
    </style>
</head>
<body>
<div data-role="page" class="jqm-demos" data-quicklinks="true">

    <div data-role="header" class="jqm-header">
        <h2>รายละเอียดการส่งหนังสือ</h2>
    </div><!-- /header -->

    <div role="main" class="ui-content jqm-content">
<?php
        $DocID 
$_GET['DocID'];
        
$DrsID $_GET['DrsID'];
        
$_SESSION['DLCID'] = $_GET['DlcID'];
        
$DLCID $_SESSION['DLCID'];
        
//echo $DocID." ".$DrsID." ".$_SESSION['DLCID'];/*die;*/

$oDoc->SearchByKey($DocID); $oDoc->GetRecord();
$oDlc->SearchByKey($_SESSION['DLCID']); $oDlc->GetRecord(); 
if(
$_SESSION['DLCIDSECOND']=="Y"){
    
$oDlc7->SearchByKey($_SESSION['DLCIDSECONDID']); $oDlc7->GetRecord(); 
    
$mypersonId=$oDlc7->personId;
}else{
    
$mypersonId=$oDlc->personId;
}        
$oDlp1->SearchByKey($oDlc->DlpID);  $oDlp1->GetRecord();
$oRs->SearchByKey($DrsID); $oRs->GetRecord(); 
$DlcdeptId=$oDlc->deptId
$DrsIDshow=$DrsID;
$getDlpIDCenter=searchGetDlpIDCenter($oDlc->DlpID);
$oSys->RSsysConfig();  $oSys->GetRecord();
?>
<form name="ff"  METHOD="POST" action="processSendDocMobile.php">
<?php include("showSendDocSignMobile.php");
include(
"showSendDocToPsMobile.php");
?>
<!--<input type="submit" name="addsend" value="ส่งหนังสือ" onClick="return checkFormat('<?php echo $mainPsselect?>','<?php echo $firstpost?>','<?php echo $getDlpIDCenter;?>');" <?php if($oDlc->DlcActive!='Y'){  echo "disabled";  }  ?>>-->
<input type="submit" name="addsend" value="ส่งหนังสือ" <?php if($oDlc->DlcActive!='Y'){  echo "disabled";  }  ?>>
                <input type="hidden" name="method"  id="method" value="addsend" >
                <input name="mainPsselect" id="mainPsselect" type="hidden">
                <input type="hidden" name="cansend" id="cansend"  value="<?php echo $cansend?>">
                <input type="hidden" name="DlcdeptId"  id="DlcdeptId"  value="<?php echo $DlcdeptId?>">
                <input type="hidden" name="DrsID" id="DrsID"  value="<?php echo $DrsID?>">
                <input type="hidden" name="DocID" id="DocID"  value="<?php echo $DocID?>">
                <input type="hidden" name="DocGroup" id="DocGroup" value="<?php echo $MaxDocGroup//echo $oDoc->DocGroup; ?>">
                 <input type="hidden" name="DlcIDlogin" id="DlcIDlogin"  value="<?php echo $DLCID?>">
                 <input type="hidden" name="personId" id="personId"  value="<?php echo $mypersonId?>">
                 <input type="hidden" name="firstpost" id="firstpost"  value="<?php echo $firstpost?>">
                  <input type="hidden" name="deletePstmp" id="deletePstmp" >
                 <input type="hidden" name="checksearchPs" id="checksearchPs" >
                 <input type="hidden" name="searchpredocdate" id="searchpredocdate"  value="<?php echo $searchpredocdate?>">
                <input type="hidden" name="selectpredocdatevalue"  id="selectpredocdatevalue"  value="<?php echo $selectpredocdatevalue?>">
                  <input type="hidden" name="searchNamePre" id="searchNamePre"  value="<?php echo $searchNamePre?>">
                <input type="hidden" name="searchNoPre"  id="searchNoPre"  value="<?php echo $searchNoPre?>">
                <input type="hidden" name="selectpreDtID"  id="selectpreDtID"  value="<?php echo $selectpreDtID?>">
                <input type="hidden" name="page_id2" id="page_id2"  value="<?php echo $page_id2?>">
                <input type="hidden" name="folderstaff2" id="folderstaff2" value="<?php echo $folderstaff2?>">
                <input type="hidden" name="forfolderstaff2"  id="forfolderstaff2" value="<?php echo $forfolderstaff2?>">    
                <input type="hidden" name="searchPreTypeNoF"  id="searchPreTypeNoF" value="<?php echo $searchPreTypeNoF?>">    
                <input type="hidden" name="searchPreTypeNoT"  id="searchPreTypeNoT" value="<?php echo $searchPreTypeNoT?>">    
<!--<table data-role="table" id="phone-table" data-mode="" data-column-btn-text="Compare..." data-column-btn-theme="a" class="phone-compare ui-shadow table-stroke">
    <tbody>
        <tr>
            <th class="label">asd</th>
            <td>asdsd</td>
            <td>dddd</td>
        </tr>
        <tr>
            <th class="label">fgfg</th>
            <td>fgfg</td>
            <td>fgfg</td>
        </tr>
    </tbody>
</table>-->
</form>
    </div><!-- /content -->
      
<!--
    <div data-role="footer" data-position="fixed" data-tap-toggle="false" class="jqm-footer">
        <p>jQuery Mobile Demos version <span class="jqm-version"></span></p>
        <p>Copyright 2014 The jQuery Foundation</p>
    </div> -->  <!-- /footer -->
    
</div><!-- /page -->

</body>
</html>
<script language="javascript">

function checkFormat(p,r,checkdlpid){
            //alert(document.ff.mainPs.value);
            //mainPsselect=document.getElementById('mainPs').value;
            //alert(mainPsselect);
            /*if(document.getElementById('AnID').value!=0 &&  document.getElementById('AnIDselected').value!='1'  && document.getElementById('DocShowIn').checked==false && document.getElementById('DocShowOut').checked==false){
                        if(!document.getElementById('DocShowIn').checked && !document.getElementById('DocShowOut').checked){
                            alert("กรุณาเลือกประเภทการแจ้งข่าวบน\nInternet (ภายนอก) และ/หรือ Intranet (ภายใน)");
                            return false;
                        }
            }
            if(document.getElementById('AnID').value!=0 && r=="1"){
                    f = document.ff;
                    var date1 = f.DrsstartDatePost.value.split("/");
                    var date2 = f.DrsendDatePost.value.split("/");
                    //Set the two dates
                    date1 = new Date(eval(date1[2]), eval(date1[1]-1), eval(date1[0]));
                    date2 = new Date(eval(date2[2]), eval(date2[1]-1), eval(date2[0])); //Month is 0-11 in JavaScript
                    //Set 1 day in milliseconds
                    var one_day = 1000*60*60*24;
                    //Calculate difference btw the two dates, and convert to days
                    var diff = Math.ceil((date2.getTime()-date1.getTime())/(one_day));
                    if(diff < 0){
                        alert("กรุณาตรวจสอบช่วง 'วันที่เริ่มต้น' ควรน้อยกว่า 'วันที่สิ้นสุด' !");
                        return false;
                    }
            }*/
                 if(checkdlpid!='Y'){
                    if(document.getElementById('PtID').value==0){
                        alert("กรุณาเลือกลักษณะหนังสือ");
                        document.getElementById('PtID').focus();
                        return false ;
                    }
                }
                if(document.getElementById('PtID').value==3){
                        if(!document.getElementById('checkDocSpeedDate').checked){
                            alert('กรุณากำหนดระยะเวลาดำเนินการ');
                            return false;
                        }
                }
                var agree=confirm("คุณต้องการส่งหนังสือแน่นอนใช่หรือไม่ ?");
                if (agree){
                /*
                    if(mainPsselect=="" || mainPsselect=="0"){
                        document.ff.mainPsselect.value=p;
                    }else{
                        document.ff.mainPsselect.value=mainPsselect;
                    }
                    */
                    document.ff.method.value="addsend";
                    return true;
                }else{
                    return false ;
                }
            
}
function checkFormatEndDoc(){
                var agree=confirm("คุณต้องการยุติหนังสือแน่นอนใช่หรือไม่ ?");
                if (agree){
                    document.ff.method.value="addenddoc";
                    return true;
                }else{
                    return false ;
                }
}
function changePtID(){
        document.ff.method.value="addsend2";
        document.ff.submit();
        return true;
}
function radioSelectType(val){
    document.ff.mainPs.value=val;
}
 function showline(p){ 
             FileName = "showlinedocTable.php?searchDoc="+p;
            var w=900;  
            var h=500;
            strOption = "scrollbars=yes,left=370,top=100,menubar=1,width=" + w + ",height=" + h;
            window.open(FileName,"",strOption);
}
 function showline2(p){ 
             FileName = "showlinedocTable2.php?searchDoc="+p;
            var w=900;  
            var h=500;
            strOption = "scrollbars=yes,left=370,top=100,menubar=1,width=" + w + ",height=" + h;
            window.open(FileName,"",strOption);
}
function up_downList(checksearchPs){
var mybrowser=navigator.userAgent;
if(checksearchPs!=1){
        if(mybrowser.indexOf('MSIE')>0){    
                if(openshow.style.display=='none'){
                    openshow.style.display='';    
                }else if(openshow.style.display==''){
                    openshow.style.display='none';        
                }
        }else{ 
                if(document.getElementById( 'openshow' ).style.display=='none'){    
                    document.getElementById( 'openshow' ).setAttribute( 'style', 'display:' );    
                }else if(document.getElementById( 'openshow' ).style.display==''){
                    document.getElementById( 'openshow' ).setAttribute( 'style', 'display:none' );        
                }    
        }
}
}
function changeDivDisplay(id)

//alert(document.ff.length+" "+id);
                for (var i=0; i<document.ff.length; i++)
                {
                    if(document.ff.elements[i].type == 'radio')
                    {   
                        if(id==0 || id==1 || id==2 || id==6){
                            document.ff.elements[i].style.display = "none";
                        }else{
                            document.ff.elements[i].style.display = "";
                        }
                    }
                }
}
function getDataDoc(searchDoc){
    if(document.gg.fileupload.value==""){
        alert("กรุณา Browse เลือกเแฟ้ม");
        return false ;
    }
    document.gg.method.value="uploadfile";
    document.gg.submit();
}
function checkDelete(DtmpID){
        var agree=confirm("คุณต้องการลบแฟ้มหนังสือนี้แน่นอนใช่หรือไม่ ?");
        if (agree){
                document.gg.DtmpID.value = DtmpID;
                document.gg.method.value="delfile";
                document.gg.submit();
        }else{
            return false ;
        }
}
function test()
{
var check_sendToPs_len = document.ff.check_sendToPs.length;
if(check_sendToPs_len==0)
{
 document.getElementById('st_val').value ='';

}
document.getElementById('st_val').value ='';

for ( i = 0; i<check_sendToPs_len ; i++)
 {
  if(document.ff.check_sendToPs[i].checked)
   {
   document.getElementById('st_val').value+=document.ff.check_sendToPs[i].value+',';
    
    }
  }
  
    
  fin_str =  document.getElementById('st_val').value;
  document.getElementById('st_val').value  = fin_str.replace(',on,','');
   
}
</script>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.008 ]--