!C99Shell v. 1.0 pre-release build #16!

Software: Apache. PHP/5.4.45 

uname -a: Linux webm115.cluster007.gra.hosting.ovh.net 5.15.74-ovh-vps-grsec-zfs-classid #1 SMP Wed
Oct 26 09:50:47 UTC 2022 x86_64
 

uid=763961(ebenisteaz) gid=100(users) groups=100(users) 

Safe-mode: OFF (not secure)

/home/ebenisteaz/www/admin/misc/elfinder-connector/   drwx---r-x
Free 0 B of 0 B (0%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     elFinderConnector.class.php (3.05 KB)      -rw----r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

/**
 * Default elFinder connector
 *
 * @author Dmitry (dio) Levashov
 **/
class elFinderConnector {
    
/**
     * elFinder instance
     *
     * @var elFinder
     **/
    
protected $elFinder;
    
    
/**
     * Options
     *
     * @var aray
     **/
    
protected $options = array();
    
    
/**
     * undocumented class variable
     *
     * @var string
     **/
    
protected $header 'Content-Type: application/json';
    
    
    
/**
     * Constructor
     *
     * @return void
     * @author Dmitry (dio) Levashov
     **/
    
public function __construct($elFinder$debug=false) {
        
        
$this->elFinder $elFinder;
        if (
$debug) {
            
$this->header 'Content-Type: text/html; charset=utf-8';
        }
    }
    
    
/**
     * Execute elFinder command and output result
     *
     * @return void
     * @author Dmitry (dio) Levashov
     **/
    
public function run() {
        
$isPost $_SERVER["REQUEST_METHOD"] == 'POST';
        
$src    $_SERVER["REQUEST_METHOD"] == 'POST' $_POST $_GET;
        
$cmd    = isset($src['cmd']) ? $src['cmd'] : '';
        
$args   = array();
        
        if (!
function_exists('json_encode')) {
            
$error $this->elFinder->error(elFinder::ERROR_CONFelFinder::ERROR_CONF_NO_JSON);
            
$this->output(array('error' => '{"error":["'.implode('","'$error).'"]}''raw' => true));
        }
        
        if (!
$this->elFinder->loaded()) {
            
$this->output(array('error' => $this->elFinder->error(elFinder::ERROR_CONFelFinder::ERROR_CONF_NO_VOL), 'debug' => $this->elFinder->mountErrors));
        }
        
        
// telepat_mode: on
        
if (!$cmd && $isPost) {
            
$this->output(array('error' => $this->elFinder->error(elFinder::ERROR_UPLOADelFinder::ERROR_UPLOAD_TOTAL_SIZE), 'header' => 'Content-Type: text/html'));
        }
        
// telepat_mode: off
        
        
if (!$this->elFinder->commandExists($cmd)) {
            
$this->output(array('error' => $this->elFinder->error(elFinder::ERROR_UNKNOWN_CMD)));
        }
        
        
// collect required arguments to exec command
        
foreach ($this->elFinder->commandArgsList($cmd) as $name => $req) {
            
$arg $name == 'FILES' 
                
$_FILES 
                
: (isset($src[$name]) ? $src[$name] : '');
                
            if (!
is_array($arg)) {
                
$arg trim($arg);
            }
            if (
$req && (!isset($arg) || $arg === '')) {
                
$this->output(array('error' => $this->elFinder->error(elFinder::ERROR_INV_PARAMS$cmd)));
            }
            
$args[$name] = $arg;
        }
        
        
$args['debug'] = isset($src['debug']) ? !!$src['debug'] : false;
        
        
$this->output($this->elFinder->exec($cmd$args));
    }
    
    
/**
     * Output json
     *
     * @param  array  data to output
     * @return void
     * @author Dmitry (dio) Levashov
     **/
    
protected function output(array $data) {
        
$header = isset($data['header']) ? $data['header'] : $this->header;
        unset(
$data['header']);
        if (
$header) {
            if (
is_array($header)) {
                foreach (
$header as $h) {
                    
header($h);
                }
            } else {
                
header($header);
            }
        }
        
        if (isset(
$data['pointer'])) {
            
rewind($data['pointer']);
            
fpassthru($data['pointer']);
            if (!empty(
$data['volume'])) {
                
$data['volume']->close($data['pointer'], $data['info']['hash']);
            }
            exit();
        } else {
            if (!empty(
$data['raw']) && !empty($data['error'])) {
                exit(
$data['error']);
            } else {
                exit(
json_encode($data));
            }
        }
        
    }
    
}
// END class 

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c99shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | Generation time: 0.0287 ]--