!C99Shell v. 1.0 pre-release build #16!

Software: Apache/2.0.54 (Fedora). PHP/5.0.4 

uname -a: Linux mina-info.me 2.6.17-1.2142_FC4smp #1 SMP Tue Jul 11 22:57:02 EDT 2006 i686 

uid=48(apache) gid=48(apache) groups=48(apache)
context=system_u:system_r:httpd_sys_script_t
 

Safe-mode: OFF (not secure)

/home/mnnews/public_html/poll/   drwxr-xr-x
Free 4.04 GB of 27.03 GB (14.93%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     common.php (6 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

### PREVENTS MULTIPLE INCLUSIONS ###
if(isset($isinc_common)) return;
$isinc_common = TRUE;

### INCASE REGISTER_GLOBALS IS DISABLED.. ###
if(is_array($HTTP_GET_VARS)) {
  
reset($HTTP_GET_VARS);
  while(list(
$k,$v) = each($HTTP_GET_VARS)) {$$k=$v;}
}
if(
is_array($HTTP_POST_VARS)) {
  
reset($HTTP_POST_VARS);
  while(list(
$k,$v) = each($HTTP_POST_VARS)) {$$k=$v;}
}
if(
is_array($HTTP_COOKIE_VARS)) {
  
reset($HTTP_COOKIE_VARS);
  while(list(
$k,$v) = each($HTTP_COOKIE_VARS)) {
    if(
ereg("^symp",$k)) {$$k=$v;}
  }
}
if(
is_array($HTTP_SERVER_VARS)) {
  
reset($HTTP_SERVER_VARS);
  while(list(
$k,$v) = each($HTTP_SERVER_VARS)) {$$k=$v;}
}
if(isset(
$sympvotes))
  {
$sympvotes=unserialize(stripslashes($sympvotes)); }
if(isset(
$sympauth))
  {
$sympauth=unserialize(stripslashes($sympauth)); }


### MAKE SURE QUERY_STRING IS SET AFTER AN SSI ###
if(!isset($QUERY_STRING) || $QUERY_STRING == "") {
if(isset(
$QUERY_STRING_UNESCAPED) && $QUERY_STRING_UNESCAPED != "") {
  
$QUERY_STRING=str_replace("\\","",$QUERY_STRING_UNESCAPED);
  
parse_str($QUERY_STRING);
}
}

### INCLUDE CONFIG INFO ###
$version = '0.4.4';
$refer_href = '<a href="http://www.ralusp.net/sympoll/">';
include
dirname(__FILE__)."/config."."$ext";
include
dirname(__FILE__)."/include/language."."$ext";

### SET SYMP_URL FOR HIGHEST POSSIBLE COMPATIBILITY ###
if(!isset($SYMP_URL) || $SYMP_URL == "") {
  
$SYMP_URL = "";
  if(!isset(
$s_dirurl))
    {
$s_dirurl = ""; }
  
$purl = parse_url($s_dirurl);

  
// path,first check for cgi on php4
  
if(function_exists("php_sapi_name") && (php_sapi_name() == "cgi"))
    {
$SYMP_URL = $PATH_INFO; }
  
// path,second try request_uri
  
elseif(isset($REQUEST_URI) && $REQUEST_URI != "") {
    
$pos = strpos($REQUEST_URI,"?");
    if(
$pos)
      {
$SYMP_URL = substr($REQUEST_URI, 0, $pos); }
    else
      {
$SYMP_URL = $REQUEST_URI; }
  }
  
// path,third try document_uri for shtml
  
elseif(isset($DOCUMENT_URI) && $DOCUMENT_URI != "")
    {
$SYMP_URL = $DOCUMENT_URI; }
  
// path,fourth try redirect_url
  
elseif(isset($REDIRECT_URL) && $REDIRECT_URL != "")
    {
$SYMP_URL = $REDIRECT_URL; }
  
// path,fifth default to php_self
  
elseif(isset($PHP_SELF) && $PHP_SELF != "")
    {
$SYMP_URL = $PHP_SELF; }
  
// path, check for cgi in php3, switch to path_info
  
$prolly_cgi = ereg("^([^.?]+[?])?([^/]+[.][^/]+)?[/]", strrev($SYMP_URL));
  if((
eregi("php\.exe",$SYMP_URL) || $prolly_cgi) &&
      (isset(
$PATH_INFO) && $PATH_INFO != ""))
    {
$SYMP_URL = $PATH_INFO; }
  
// add filename if necessary
  
if(ereg("[/]$", $SYMP_URL)) {
    if(isset(
$DOCUMENT_NAME) && $DOCUMENT_NAME != "")
      {
$SYMP_URL = "$SYMP_URL"."$DOCUMENT_NAME"; }
    else
      {
$SYMP_URL = "$SYMP_URL".basename($PHP_SELF); }
  }

  
// port,first check config file
  
if(isset($purl['port']) && $purl['port'] != "")
    {
$SYMP_URL = ":"."$purl[port]"."$SYMP_URL"; }
  
// port,second try SERVER_PORT if not 80
  
elseif(isset($SERVER_PORT) && $SERVER_PORT != "" && $SERVER_PORT != "80")
    {
$SYMP_URL = ":"."$SERVER_PORT"."$SYMP_URL"; }

  
// hostname,first use config file
  
if(isset($purl['host']) && $purl['host'] != "")
    {
$SYMP_URL = "$purl[host]"."$SYMP_URL"; }
  
// hostname,second try http_host
  
elseif(isset($HTTP_HOST) && $HTTP_HOST != "")
    {
$SYMP_URL = "$HTTP_HOST"."$SYMP_URL"; }
  
// hostname,third try server_name
  
elseif(isset($SERVER_NAME) && $SERVER_NAME != "")
    {
$SYMP_URL = "$SERVER_NAME"."$SYMP_URL"; }

  
//hack fix
  
if(eregi(".\.proxad\..",$SERVER_NAME) || eregi("\.proxad\.",$HTTP_HOST)) {
    if(isset(
$PATH_INFO) && ereg("^[/]([^./]+[.])+[^./]+[/]", $PATH_INFO))
      {
$SYMP_URL = substr($PATH_INFO, 1); }
  }

  
// protocol,first check https
  
if(isset($HTTPS) && $HTTPS != "" && $HTTPS != "off")
    {
$SYMP_URL = "https://"."$SYMP_URL"; }
  
// protocol,second use http
  
else
    {
$SYMP_URL = "http://"."$SYMP_URL"; }
}


### DETECT REMOTE IP THROUGH PROXIES IF IP LOGGING ENABLED ###
if($s_iplog != "0") {
  
$need_ip = TRUE;
  
$ip_ereg = "^(([0-9]{1,3}\.){3,3}[0-9]{1,3})";
  if(isset(
$HTTP_X_FORWARDED_FOR) && $HTTP_X_FORWARDED_FOR != "") {
    
$dsr = ereg($ip_ereg, $HTTP_X_FORWARDED_FOR, $a);
    if(
$dsr && isset($a[1]) && $a[1] != "")
      {
$REMOTE_ADDR = $a[1]; $need_ip = FALSE; }
  }
  if(
$need_ip && isset($HTTP_X_FORWARDED) && $HTTP_X_FORWARDED != "") {
    
$dsr = ereg($ip_ereg, $HTTP_X_FORWARDED, $a);
    if(
$dsr && isset($a[1]) && $a[1] != "")
      {
$REMOTE_ADDR = $a[1]; $need_ip = FALSE; }
  }
  if(
$need_ip && isset($HTTP_FORWARDED_FOR) && $HTTP_FORWARDED_FOR != "") {
    
$dsr = ereg($ip_ereg, $HTTP_FORWARDED_FOR, $a);
    if(
$dsr && isset($a[1]) && $a[1] != "")
      {
$REMOTE_ADDR = $a[1]; $need_ip = FALSE; }
  }
  if(
$need_ip && isset($HTTP_FORWARDED) && $HTTP_FORWARDED != "") {
    
$dsr = ereg($ip_ereg, $HTTP_FORWARDED, $a);
    if(
$dsr && isset($a[1]) && $a[1] != "")
      {
$REMOTE_ADDR = $a[1]; $need_ip = FALSE; }
  }
}

### NEEDED TO GET AROUND AN UNFIXED IIS BUG ###
function do_redir($url) {
  global
$SERVER_SOFTWARE;
  
symp_disconnect(TRUE);
  if(isset(
$SERVER_SOFTWARE) && ereg("IIS", $SERVER_SOFTWARE)) {
    
header("Refresh: 0; URL=${url}");
    echo
"<html><body bgcolor=\"#000000\">&nbsp;</body></html>";
  } else {
    
header("Location: ${url}");
  }
  exit();
}

### DATABASE WRAPPER FUNCTIONS ###
$s_dbid = FALSE;
$s_dbnum = 0;

function
symp_connect() {
  global
$s_dbhost, $s_dbuser, $s_dbpass, $s_dbname;
  global
$s_dbid, $s_dbnum;
  if(
$s_dbid && $s_dbnum > 0) {
    
$s_dbnum = $s_dbnum + 1;
  } else {
    
$s_dbid = mysql_connect($s_dbhost, $s_dbuser, $s_dbpass);
    if(!
$s_dbid || !mysql_select_db($s_dbname, $s_dbid))
      { die(
"A database error has occured!\n"); }
    
$s_dbnum = 1;
  }
}

function
symp_disconnect($full=FALSE) {
  global
$s_dbid, $s_dbnum;
  if(
$s_dbid && ($full || $s_dbnum <= 1)) {
    
mysql_close($s_dbid);
    
$s_dbid = FALSE;
    
$s_dbnum = 0;
  } elseif(!
$s_dbid) {
    
$s_dbnum = 0;
  } else {
    
$s_dbnum = $s_dbnum - 1;
  }
}

?>

:: Command execute ::

Enter:
 
Select:
 

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c99shell v. 1.0 pre-release build #16 powered by Captain Crunch Security Team | http://ccteam.ru | Generation time: 0.0046 ]--