!C99Shell v. 1.0 pre-release build #13!

Software: Apache. PHP/5.5.15 

uname -a: Windows NT SVR-DMZ 6.1 build 7600 (Windows Server 2008 R2 Enterprise Edition) i586 

SYSTEM 

Safe-mode: OFF (not secure)

E:\xampp\xampp\htdocs\jaime\blog\   drwxrwxrwx
Free 7.97 GB of 239.26 GB (3.33%)
Detected drives: [ a ] [ c ] [ d ] [ e ] [ f ]
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     commentSystem.php (1.3 KB)      -rw-rw-rw-
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?
    
    if($_GET['type'] == "newComment"){
        $message = stripslashes($_POST['message']);
        $name = $_POST['name'];
        $number = 1 + $_POST['number'];
        $number -= 1;
        $myString = "";
        $xml = simplexml_load_file('comments.xml');
        $entries = $xml->entry;
        $myString .= "<?xml version=\"1.0\" encoding=\"iso-8859-1\"?>";
        $myString .= "\n";
        $myString .= "<comments>\n";
        for($i=0;$i<sizeof($entries);$i++){    
        $comments = $xml->entry[$i]->comment;
        $myString .= "<entry>\n";
            for($r=0;$r<sizeof($comments);$r++){
                $myString .= "<comment>";
                $string = (string)$xml->entry[$i]->comment[$r];    
                $string = str_replace("&","&amp;",$string);
                $string = str_replace("%","&#37;",$string);
                $string = str_replace("<","&lt;",$string);
                $string = str_replace(">","&gt;",$string);
                $string = str_replace("'","&apos;",$string);
                $string = str_replace("\"","&quot;",$string);
                $myString .= $string;
                $myString .= "</comment>\n";
            }
            if($i == $number){
                $myString .= "<comment>";
                $myString .= $name . ": " . $message;
                $myString .= "</comment>\n";
            }
            $myString .= "</entry>\n";            
        }
        $myString .= "</comments>";
        //echo $myString;
        if($myFile = fopen("comments.xml","w"))
        {
            fwrite($myFile,$myString);
            echo "sentOk=true&testing=123";
        }
    }
?>

:: Command execute ::

Enter:
 
Select:
 

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c99shell v. 1.0 pre-release build #13 powered by Captain Crunch Security Team | http://ccteam.ru | Generation time: 0.0156 ]--