!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/stdalumni/application/controllers/ums/   drwxr-xr-x
Free 50.91 GB of 127.8 GB (39.84%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     group.php (6.48 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
require("ums_controller.php");
class 
Group extends Ums_controller {
    public 
$data;
    
    function 
index() {
        
$this->load->model($this->config->item("ums_folder")."m_umgroup","m_umgroup");
        
$m_umgroup $this->m_umgroup;
        
$this->data["group"] = $m_umgroup->get()->result();
        
$this->output("v_umGroupShow");
    }
    
    function 
umGroupEdit(){
        if(
$this->input->post("submit")){ //SAVE
            
$this->load->model($this->config->item("ums_folder")."m_umgroup","m_umgroup");
            
$m_umgroup $this->m_umgroup;
            
$m_umgroup->GpID $this->input->post("GpID");
            
$m_umgroup->GpNameT $this->input->post("GpNameT");
            
$m_umgroup->GpNameE $this->input->post("GpNameE");
            
$m_umgroup->GpDesc $this->input->post("GpDesc");
            
$m_umgroup->GpStID $this->input->post("GpStID");
            
$m_umgroup->GpDefaultAll $this->input->post("GpDefaultAll");
            
$m_umgroup->update();
            
redirect(site_url()."/".$this->config->item("ums_folder")."group");
        }
        
        
// system All
        
$this->load->model($this->config->item("ums_folder")."m_umsystem","m_umsystem");
        
$m_umsystem $this->m_umsystem;
        
$this->data["system"] = $m_umsystem->get()->result();
        
$m_umsystem->StID $this->input->post("StID");
        
$this->data['system_name'] = $m_umsystem->get_by_key();
        
        
// wgroup All
        
$this->load->model($this->config->item("ums_folder")."m_umwgroup","m_umwgroup");
        
$m_umwgroup $this->m_umwgroup;
        
$this->data["wgroup"] = $m_umwgroup->get_all()->result();
        
        
// Group by id
        
$GpID $this->input->post("GpID");
        
$this->load->model($this->config->item("ums_folder")."m_umgroup","m_umgroup");
        
$m_umgroup $this->m_umgroup;
        
$this->data["group"] = $m_umgroup->getByKey($GpID);
        
        
$this->data["edit"] = true;
        
$this->output("v_umGroupForm");
    }
    
    function 
umGroupAdd(){
        if(
$this->input->post("submit")){ //SAVE
            
$GpNameT $this->input->post("GpNameT");
            
$GpNameE $this->input->post("GpNameE");
            
$GpDesc $this->input->post("GpDesc");
            
$GpStID $this->input->post("GpStID");
            
$GpDefaultAll $this->input->post("GpDefaultAll");
            
$this->load->model($this->config->item("ums_folder")."m_umgroup","m_umgroup");
            
$m_umgroup $this->m_umgroup;
            
$m_umgroup->GpNameT $GpNameT;
            
$m_umgroup->GpNameE $GpNameE;
            
$m_umgroup->GpDesc $GpDesc;
            
$m_umgroup->GpStID $GpStID;
            
$m_umgroup->GpDefaultAll $GpDefaultAll;
            
// GpID
            
$lastGpID $m_umgroup->getIdByStId();
            if(
$lastGpID == 0){
                
$m_umgroup->GpID $GpStID.str_pad(1,3"0"STR_PAD_LEFT);
            } else {
                
$m_umgroup->GpID str_pad($lastGpID+1,3"0"STR_PAD_LEFT);
            }
            
// 
            //var_dump($m_umgroup);die;
            
$m_umgroup->insert();
            
redirect(site_url()."/".$this->config->item("ums_folder")."group");
        }
        
        
// system All
        
$this->load->model($this->config->item("ums_folder")."m_umsystem","m_umsystem");
        
$m_umsystem $this->m_umsystem;
        
$this->data["system"] = $m_umsystem->get()->result();
        
        
// wgroup All
        
$this->load->model($this->config->item("ums_folder")."m_umwgroup","m_umwgroup");
        
$m_umwgroup $this->m_umwgroup;
        
$this->data["wgroup"] = $m_umwgroup->get_all()->result();
        
        
$this->output("v_umGroupForm");
    }
    
    function 
umGroupDelete(){
        
$GpID $this->input->post("GpID");
        
        
$this->load->model($this->config->item("ums_folder")."m_umgroup","m_umgroup");
        
$m_umgroup $this->m_umgroup;
        
$m_umgroup->delete($GpID);
        
        
$this->load->model($this->config->item('ums_folder').'m_umgpermission','m_umgpermission');
        
$m_umgpermission $this->m_umgpermission;
        
$m_umgpermission->deleteByGpID($GpID);
        
        
redirect(site_url()."/".$this->config->item("ums_folder")."group");
    }
    
    
/*
    * Set Group Permission Menu
    * @author    beeroma
    * @Create Date 2554-10-27
    */
    
function umGroupPermission(){
        if(
$this->input->post("submit")){ //SAVE
            
$this->load->model($this->config->item('ums_folder').'m_umgpermission','m_umgpermission');
            
$m_umgpermission $this->m_umgpermission;
            
$StID $this->input->post('StID');
            
$GpID $this->input->post("GpID");
            
$m_umgpermission->deleteByGpID($GpID);
            foreach(
$_POST["menu"] as $value){
                
$this->load->model($this->config->item('ums_folder').'m_umgpermission','m_umgpermission');
                
$m_umgpermissionInsert $this->m_umgpermission;
                
$m_umgpermissionInsert->gpSeq 0;
                
$flag 1;
                
// X
                
$key $value "_x";
                if(empty(
$_POST[$key])){
                    
$flag 0;
                    
$m_umgpermissionInsert->gpX 0;
                } else {
                    
$m_umgpermissionInsert->gpX 1;
                }
                
// C
                
$key $value "_c";
                if(empty(
$_POST[$key])){
                    
$flag 0;
                    
$m_umgpermissionInsert->gpC 0;
                } else {
                    
$m_umgpermissionInsert->gpC 1;
                }
                
// R
                
$key $value "_r";
                if(empty(
$_POST[$key])){
                    
$flag 0;
                    
$m_umgpermissionInsert->gpR 0;
                } else {
                    
$m_umgpermissionInsert->gpR 1;
                }
                
// U
                
$key $value "_u";
                if(empty(
$_POST[$key])){
                    
$flag 0;
                    
$m_umgpermissionInsert->gpU 0;
                } else {
                    
$m_umgpermissionInsert->gpU 1;
                }
                
// D
                
$key $value "_d";
                if(empty(
$_POST[$key])){
                    
$flag 0;
                    
$m_umgpermissionInsert->gpD 0;
                } else {
                    
$m_umgpermissionInsert->gpD 1;
                }
                
                if(
$flag == 0){
                    
$m_umgpermissionInsert->gpMnID $value;
                    
$m_umgpermissionInsert->gpGpID $GpID;
                    
$m_umgpermissionInsert->insertPermission();
                }
            }
            
$url site_url()."/".$this->config->item("ums_folder")."group/umGroupPermission";
            
$post = array("GpID"=>$GpID,"StID"=>$StID);
            
redirect_post($url,$post);
        } else {
            
$StID $this->input->post('StID');
            
$GpID $this->input->post('GpID');

            
// System
            
$this->load->model($this->config->item('ums_folder').'m_umsystem','m_umsystem');
            
$m_umsystem=$this->m_umsystem;
            
$m_umsystem->StID $StID;
            
$this->data['system'] = $m_umsystem->get_by_key();
            
            
// Group
            
$this->load->model($this->config->item("ums_folder")."m_umgroup","m_umgroup");
            
$m_umgroup $this->m_umgroup;
            
$this->data["group"] = $m_umgroup->getByKey($GpID);
            
            
$this->data['StID'] = $StID;
            
$this->data['GpID'] = $GpID;
            
$this->data['menu'] = $this->umGroupPermissionRe(0,$StID,$GpID);
            
            
$this->output("v_umGroupPermissionForm");
        }
    }
    
    function 
umGroupPermissionRe($MnID,$StID,$GpID){
        
$this->load->model($this->config->item('ums_folder').'m_ummenu','m_ummenu');
        
$m_ummenu=$this->m_ummenu;
        
$menu $m_ummenu->RSByParentMnPermissionGroup($MnID,$StID,$GpID);
        
        if(
$menu->num_rows>0){
            foreach(
$menu->result() as $row){
                
$result[$row->MnID]['data'] = $row;
                
$result[$row->MnID]['child'] = $this->umGroupPermissionRe($row->MnID,$StID,$GpID);
            }
            return 
$result;
        } else {
            return 
false;
        }
    }
    
}

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0192 ]--