110.164.51.230 - phpshell

!c99Shell v. 1.0 pre-release build #16!
Software: Apache/2.2.3 (CentOS). PHP/5.1.6 uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44 EDT 2010 i686 uid=48(apache) gid=48(apache) groups=48(apache) Safe-mode: OFF (not secure) /var/www/html/reportEregis111/ drwxr-xr-x Free 52.66 GB of 127.8 GB (41.2%) Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update Feedback Self remove Logout

!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686

uid=48(apache) gid=48(apache) groups=48(apache)

Safe-mode: OFF (not secure)

/var/www/html/reportEregis111/ drwxr-xr-x
Free 52.66 GB of 127.8 GB (41.2%)
Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update Feedback Self remove Logout

Viewing file: clsUser.php (10.06 KB) -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |

<?php
include_once("global.php");
if (!class_exists("clsConnection"))
    include_once("../class/clsConnection.php");
if (!class_exists("clsDB"))
    include_once("../class/clsDB.php");
class clsUser{
var $c;

var $userID;					//а»ЕХиВ№аБЧиН login
var $userLogin;				//ГЛСКєШ¤ЕТЎГ ГЛСК№СЎИЦЎЙТ 
var $userPassword;			//
var $userIP	;
var $userName;
var $active;

var $deptId;
var $deptName;
var $deptCode;

//var $userDptCode;			//дБидґйгЄй
//var $userDptName;		//дБидґйгЄй
//var $userPosCode;			//дБидґйгЄй
//var $userPosName;		//дБидґйгЄй

var $userPsID;					//id ўН§єШ¤ЕТЎГ   ГЛСК№ФКФµ
var $userPsCode;				//ГЛСКєШ¤ЕТЎГ	personID

var $SessionID;
var $Lang = "th";

var $WgID;					//is set when login
							//ЎЕШиБ:: 	1 јЩйґЩбЕГРєє, 2 јЩйєГФЛТГГРґСєКЩ§, 3 јЩйєГФЛТГ, 
							//		4 аЁйТЛ№йТ·Хи, 	 5 НТЁТГВм, 		  6 №СЎИЦЎЙТ 
var $StID;					//StID ўН§ГРєє·ХиаЕЧНЎЁТЎаБ№ЩКдЕґмґйТ№ўйТ§ ¶ЩЎа»ЕХиВ№вґ№ main menu
var $GpID;					//GpID ЎЕШиБГРєє§Т№·ХиаЕЧНЎ	 ¶ЩЎа»ЕХиВ№вґ№ main menu

var $MmnID;					//¶ЩЎа»ЕХиВ№вґВаБ№ЩЛЕСЎ
var $MnID;					//¶ЩЎа»ЕХиВ№вґВаБ№Щ

var $X;
var $C;
var $R;
var $U;
var $D;	

var $aGp;					//array ўН§ permission
var $aUp;					//ЁР¶ЩЎаѕФиБг№бїйБ check login

function clsUser(){

	$this->c = new clsConnection($GLOBALS['HOST'], $GLOBALS['DB'], $GLOBALS['USER'], $GLOBALS['PASSWORD']);

	$this->aGp=array('00'=>array(0,0,0,0,0));
	$this->aUp=array('00'=>array(0,0,0,0,0));
}	

function getLoginName(){ return $this->userLogin; }
function getUserIP(){ return $this->userIP; }
function getName(){ return $this->userName; }
function getDptCode(){ return $this->userDptCode; }
function getDptName(){ return $this->userDptName; }
function checkAA(){ return true; }
function isExpire(){ return false; }
function isActive(){ return $this->active; }
function getKeyUP(){ return $this->userID.$this->MnID; }
function getKeyGP(){ return $this->GpID.$this->MnID; }

function GetRightsByMenu(){
	global $oU;
	if (array_key_exists($this->getKeyUP(), $this->aUp)){
		//echo "found in user permission.";
		$this->X=$this->aUp[$this->getKeyUP()][0];
		$this->C=$this->aUp[$this->getKeyUP()][1];
		$this->R=$this->aUp[$this->getKeyUP()][2];
		$this->U=$this->aUp[$this->getKeyUP()][3];
		$this->D=$this->aUp[$this->getKeyUP()][4];
	}elseif (array_key_exists($this->getKeyGP(),$this->aGp)){
		//echo "found in group permission.";
		$this->X=$this->aGp[$this->getKeyGP()][0];
		$this->C=$this->aGp[$this->getKeyGP()][1];
		$this->R=$this->aGp[$this->getKeyGP()][2];
		$this->U=$this->aGp[$this->getKeyGP()][3];
		$this->D=$this->aGp[$this->getKeyGP()][4];
	}else{
		//echo "get all permissions.";
		$this->X=1;
		$this->C=1;
		$this->R=1;
		$this->U=1;
		$this->D=1;	
	}
	//ўТґКиЗ№єС№·ЦЎЕ§ log
}

function CRUD($link, $linktype){
	$linktype=strtolower($linktype);
	if (strpos("crud",$linktype)===false) die("Є№ФґўН§ Link µйН§а»з№ CRUD а·иТ№Сй№");
	$flg = false;
	if ($linktype=="c" and $this->C==0)
		 $flg=true;
	elseif ($linktype=="r" and $this->R==0) 
		$flg=true;
	elseif ($linktype=="u" and $this->U==0)
		$flg=true;
	elseif ($linktype=="d" and $this->D==0) 
		$flg=true;
	if ($flg==false){
		return  $link;
	}else{
		$link=trim($link);			
		$s = strtolower($link);
		//----------------------------------------------------------------
		//find image name
		//			$input="images/del.gif";
		//			$output = "images/delgrey.gif";		// use explode fn
		//			$this->createGreyFromGifJpg($input, $output);
		//---------------------------------------------------------------
		//rename imagename.gif to imagenamegrey.gif
		$pGif = strpos($s,".gif");
		if ($pGif===false){
		}else{
			$ss = substr_replace($link, "grey", $pGif).substr($link, $pGif);
			$link = $ss;
			$s = strtolower($link);
		}
		//rename imagename.jpg to imagenamegrey.jpg
		$pJpg = strpos($s,".jp");
		if ($pJpg===false){
		}else{
			$ss = substr_replace($link, "grey", $pJpg).substr($link, $pJpg);
			$link = $ss;
			$s = strtolower($link);
		}			
		//add disabled to input tag
		$pos = strpos($s,"input");
		if ($pos===false){
		}else{
			$ss = substr_replace($link, "input disabled", $pos).substr($link, $pos+5);
			$link = $ss;
			$s = strtolower($link);
		}
		//change onclick-->onklick
		$pOnClick = strpos($s,"onclick");
		if ($pOnClick===false){
		}else{
			$ss = substr_replace($link, "onklick", $pOnClick).substr($link, $pOnClick+7);
			$link = $ss;
			$s = strtolower($link);				
		}
		////////////
		//disable tag A 
		$pHref = strpos($s,"href");
		if ($pHref===false){
		}else{
			$ss = substr_replace($link, "href1", $pHref).substr($link, $pHref+4);
			$link = $ss;
			$s = strtolower($link);
		}			
		//disable text between tag A and not have tag img 
		$pImg = strpos($s,"<img")===false;
		if ($pImg===false){			
			if (substr($s,0,2)=="<a"){
				$p1 = strpos($link,">");
				$p2 = strpos($link,"</");
				$ss = "<font color=#999999>".substr($link, $p1+1,$p2)."</font>";
				$link =  $ss;
				$s = strtolower($link);
			}
		}
		return $link;
	}
}

///////////////////	
function addNewUser($UsID, $UsName, $UsWgID, $UsStID=-1, $UsLogin="", $UsPassword="", $UsActive=1, $UsAdmin=0){
	//used in import module
	//UsID	єШ¤ЕТЎГгЄй personID, №ФКФµгЄй ГЛСК№ФКФµ
	//UsLogin	= personCode, studentCode
	//ГЛСКєШ¤ЕТЎГ/ГЛСК№СЎИЦЎЙТ, ЄЧиН, ЎЕШиБ§Т№, ГРєє§Т№, ЄЧиНЕкНЎНФ№, ГЛСКјиТ№, active, admin
	//ЎЕШиБ§Т№:: 1 јЩйґЩбЕГРєє, 2 јЩйєГФЛТГГРґСєКЩ§, 3 јЩйєГФЛТГ, 4 аЁйТЛ№йТ·Хи·ШЎЅиТВ, 5 НТЁТГВм(дБидґйгЄй), 6 №СЎИЦЎЙТ 
	//ГРєє§Т№:: -1 дБиГРєШ, 7 ·РаєХВ№, 4 єШ¤ЕТЎГ, 2 e-office, 3 ЎУЎСє§є, 5, 6, 7, 8, 9, 10, ...

	include_once("global.php");
	include_once("../class/clsConnection.php");
	include_once("clsUmUser.php");
	include_once("clsUmUserGroup.php");
	
	$oCu = new clsConnection($GLOBALS['HOST'], $GLOBALS['DB'], $GLOBALS['USER'], $GLOBALS['PASSWORD']);
	$oUs = new umuser($oCu);
	$oUg = new umusergroup($oCu);
	
	$oCu->BeginTrans();
	$oUs->AddNew();
	$oUs->UsPsCode=$UsID;						//¶йТа»з№№ФКФµгЛйа»з№ UsID, personID
	$oUs->UsName=$UsName;
	$oUs->UsWgID=$UsWgID;						//ЎЕШиБ§№µйН§ЎУЛ№ґБТЁТЎЛ№йТ import вґВЎТГ gen
	if($UsLogin=="") $UsLogin=$UsID;				//¶йТа»з№№ФКФµгЛйа»з№ UsID
	$oUs->UsLogin=$UsLogin;							
	if($UsPassword=="") $UsPassword=$UsID;		//¤ЗГЁРЎУЛ№ґБТЁТЎЛ№йТ import вґВЎТГ gen
	$oUs->UsPassword=md5("O]O".$UsPassword."O[O");
	$oUs->UsActive=$UsActive;
	$oUs->UsAdmin=$UsAdmin;	
	$oUs->Save();	
	////////////////////////////////////////////////////
	//add usergroup µТБЎЕШиБГРєє§Т№
	///////////////////////////////////////////////////
	//дБиГРєШЎЕШиБ ЁРгЛйКФ·ёФма»з№јЩйгЄй·СиЗд»
	if($UsWgID=4 and $UsStID == -1){
		$oUg->AddNew();
			$oUg->UgUsID=$oUs->UsID;
			$oUg->UgGpID=100108;							//јЩйгЄй·СиЗд»ГРєєКТГєГГі
			$oUg->Save();
		$oUg->AddNew();
			$oUg->UgUsID=$oUs->UsID;
			$oUg->UgGpID=40044;								//јЩйгЄй·СиЗд»ГРєєєШ¤ЕТЎГ
			$oUg->Save();
		$oUg->AddNew();
			$oUg->UgUsID=$oUs->UsID;
			$oUg->UgGpID=130131;							//јЩйгЄй·СиЗд»ГРєєєГФЎТГК№СєК№Ш№·СиЗд»
			$oUg->Save();
		$oUg->AddNew();
			$oUg->UgUsID=$oUs->UsID;
			$oUg->UgGpID=130132;							//јЩйН№ШБСµФГРєєєГФЎТГК№СєК№Ш№·СиЗд»
			$oUg->Save();
		$oUg->AddNew();
			$oUg->UgUsID=$oUs->UsID;
			$oUg->UgGpID=150154;							//јЩйгЄй·СиЗд»ГРєє»ГРЄШБНФаЕзЎ·ГН№ФЎКм
			$oUg->Save();
	}
	//ГРєє·РаєХВ№
	if ($UsStID==70){
		$oUg->AddNew();
		$oUg->UgUsID=$oUs->UsID;
		//ЎУЛ№ґГЛСКЎЕШиБГРєє§Т№		
		if ($UsWgID==4) $oUg->UgGpID=70070;			//аЁйТЛ№йТ·Хи 
		if ($UsWgID==5) $oUg->UgGpID=70071;			//НТЁТГВм
		if ($UsWgID==6) $oUg->UgGpID=70072;			//№СЎИЦЎЙТ 
		//if ($UsWgID==4) $oUg->UgGpID=70073;			//ЛНѕСЎ№СЎИЦЎЙТ 
		//if ($UsWgID==4) $oUg->UgGpID=70074;			//Л№иЗВбЁй§Л№Хй
		$oUg->Save();
	}
	
	$oCu->CommitTrans();
}

function changePassword($UsLogin, $oldPassword, $newPassword){
	include_once("clsUmUser.php");
	$oUs = new umuser($this->c);	
	$oUs->SearchByLogin($UsLogin, $oldPassword);
	if ($oUs->GetRecord()){
		$oUs->Edit();
		$oUs->UsPassword=md5("O]O".$newPassword."O[O");		
		$oUs->Save();	
		return 1;
	}else{
		return 0;	
	}
}

function deleteUser($UsCode, $password){
	include_once("clsUmUser.php");
	$oUs = new umuser($this->c);	
	$oUs->SearchByLogin($UsCode, $password);
	if ($oUs->GetRecord()){
		$oUs->Delete();
		return 1;
	}else{
		return 0;	
	}
}

function updateGroupDefault(){
	include_once("../class/clsConnection.php");
	include_once("../class/clsDB.php");
	include_once("clsUmUser.php");
	include_once("clsUmUserGroup.php");
	include_once("clsUmGroupDefault.php");
	include_once("global.php");
	$oCu = new clsConnection($GLOBALS['HOST'], $GLOBALS['DB'], $GLOBALS['USER'], $GLOBALS['PASSWORD']);
	$oUs = new umuser($oCu);
	$oUg = new umusergroup($oCu);
	$oGd = new umgroupdefault($oCu);
	
	$oCu->BeginTrans();
	$oUs->RSumuser();
	while($oUs->GetRecord()){
		$oGd->RSGroupDefaultByWg($oUs->UsWgID);
		while($oGd->GetRecord()){
			$oUg->SearchByKey($oGd->GdGpID, $oUs->UsID);
			if(!$oUg->GetRecord()){
				$oUg->AddNew();
				$oUg->UgUsID=$oUs->UsID;
				$oUg->UgGpID = $oGd->GdGpID;
				$oUg->Save();
			}
		}
	}
	$oCu->CommitTrans();
}

function updateUser(){}

function addGroup($personID, $gpID){
	include_once("clsUmUserGroup.php");
	include_once("clsUmUser.php");
	$oUg = new umusergroup($this->c);
	$oUs = new umuser($this->c);
	//echo "gpID = $gpID<br>";
	//echo "personID = $personID<br>";
	$oUs->SearchByPersonID($personID);
	if ($oUs->GetRecord()){
		//echo "usID = $oUs->UsID<br>";
		$oUg->SearchByKey($gpID, $oUs->UsID);
		if (!$oUg->GetRecord()){
			$oUg->AddNew();
			$oUg->UgGpID=$gpID;
			$oUg->UgUsID=$oUs->UsID;
			$oUg->Save();
			return 1;	
		}else{
			return 0;
		}
	}
}

function delGroup($personID, $gpID){
	include_once("clsUmUserGroup.php");
	include_once("clsUmUser.php");
	$oUg = new umusergroup($this->c);
	$oUs = new umuser($this->c);
	$oUs->SearchByPersonID($personID);
	if ($oUs->GetRecord()){
		$oUg->SearchByKey($gpID,$oUs->UsID);
		if ($oUg->GetRecord()){
			$oUg->Delete();
			return 1;	
		}else{
			return 0;
		}
	}
}

function SearchByPsCodeAndPasswd($psCode, $passwd){
	//include_once("global.php");
	//include_once("../class/clsConnection.php");
	//include_once("../class/clsDB.php");
	include_once("clsUmUser.php");
	$oCu = new clsConnection($GLOBALS['HOST'], $GLOBALS['DB'], $GLOBALS['USER'], $GLOBALS['PASSWORD']);
	$oUs = new umuser($oCu);	
	$oUs->SearchByPsCode($psCode);
	if ($oUs->GetRecord() && $oUs->UsPassword==md5("O]O".$passwd."O[O")){
		return 1;
	}else{
		return 0;	
	}
}

}	//end class
?>

:: Command execute ::
Enter:	Select:

:: Shadow's tricks :D ::
Useful Commands Warning. Kernel may be alerted using higher levels	Kernel Info:

:: Preddy's tricks :D ::
Php Safe-Mode Bypass (Read Files) File: eg: /etc/passwd	Php Safe-Mode Bypass (List Directories): Dir: eg: /etc/

:: Search ::

:: Upload ::

:: Make Dir ::

:: Make File ::

:: Go Dir ::

:: Go File ::

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0056 ]--