shell bypass 403
<?php
ini_set('display_errors', 'off');
function e($msg = "Unable to get statistics", $code = 1) {
echo $msg."\n";
exit($code);
}
function get_opt($argv, $required = array()){
$return = array();
foreach($argv as $a) {
if (strpos($a, '--') === false) continue;
preg_match('/\-\-(.+)=(.+)/',$a, $m);
if (empty($m)) continue;
$return[$m[1]] = $m[2];
}
if (!empty($required)) {
foreach($required as $r) {
if (empty($return[$r])) return false;
}
}
return $return;
}
if (!$o = get_opt($argv, array('host', 'dirdata'))) {
e();
}
extract($o);
// Output parameter
if (!empty($output)) {
$args['output'] = "-output=" . escapeshellarg($output);
} else {
$output = 'main';
$args['output'] = "-output=main";
}
// Validate $year and $month
if (!empty($year) || !empty($month)) {
$args['year'] = "-year=" . escapeshellarg($year);
$args['month'] = "-month=" . escapeshellarg($month);
} else {
$args['month'] = $args['year'] = '';
}
// Staticlinks parameter
if (empty($staticlinks)) {
$args['staticlinks'] = "-staticlinks=" . escapeshellarg("/statistics/host-web-awstats/?output=");
} else {
$args['staticlinks'] = escapeshellarg($staticlinks);
}
// Set env variables for awstats.pl
putenv("AWSTATS_SITE_DOMAIN={$host}");
putenv("AWSTATS_DIRDATA={$dirdata}");
// Generate the view with the awstats.pl
exec("perl /usr/local/hosting/awstats/awstats.pl -config=/usr/local/hosting/awstats/awstats.config ". implode(" ", $args), $view, $return);
$view = implode("\n", $view);
// Get available dates
exec("ls -1 $dirdata | grep -E 'awstats([0-9])+' -o | grep -E '[0-9]+' -o", $tmp_output, $return);
foreach ($tmp_output as $to) {
$m = (int)substr($to, 0, 2);
$y = (int)substr($to, 2);
$available_dates[$y][] = $m;
}
krsort($available_dates);
foreach($available_dates as &$a) arsort($a);
ob_start();
?>
<style type='text/css'>
body { padding-top: 40px; }
.awstats_date_select{
text-align:center;
position:absolute;
top:20px;
}
.awstats_date_select label { font-weight:bold; }
</style>
<?
$css = ob_get_contents();
ob_end_clean();
// Check for the file
if ($month != 'all' && !file_exists($dirdata . "/awstats".date('m', mktime(0, 0, 0, $month))."{$year}.txt")) {
//$no_data_warning = "No statistics found for " . date("F", mktime(0, 0, 0, $month)). " $year";
echo "<p style=\"color: #F8B403\">No statistics found for " . date("F", mktime(0, 0, 0, $month)). " $year</p>";
}
?>
<?php
$currently_selected = (empty($month) ? date('n') : $month) . "_" . (empty($year) ? date('Y') : $year);
ob_start();
?>
<form style="left:10px;" action="" method="GET" class="awstats_date_select">
<label for="month_year">Monthly reports:</label>
<select name="month_year" id="month_year">
<?php foreach($available_dates as $y => $months){ foreach($months as $m) {?>
<option <?php if ($currently_selected == "{$m}_{$y}") echo "selected='selected' ";?>value="<?="{$m}_{$y}";?>"><?=date("F", mktime(0, 0, 0, $m))." ".$y;?></option>
<?php }} ?>
</select>
<input type="hidden" name="host" value="<?=trim($host,"'");?>" />
<input type="hidden" name="output" value="<?=$output;?>" />
<input type="submit" value="Show" />
</form>
<form style="right:10px;" action="" method="GET" class="awstats_date_select">
<label for="year">Yearly reports:</label>
<select name="year" id="year">
<?php foreach(array_keys($available_dates) as $y): ?>
<option <?php if (!empty($year) && $year == $y) echo "selected='selected' ";?>value="<?=$y;?>"><?=$y;?></option>
<?php endforeach; ?>
</select>
<input type="hidden" name="month" value="all" />
<input type="hidden" name="host" value="<?=trim($host,"'");?>" />
<input type="hidden" name="output" value="<?=$output;?>" />
<input type="submit" value="Show" />
</form>
<?php
$form = ob_get_contents();
ob_end_clean();
$view = str_replace("</head>", $css . "\n</head>\n", $view);
$view = preg_replace("/<body (.+)>/", "<body $1>\n{$form}\n", $view);
//$view = str_replace("</body>", "{$form}\n</body>\n", $view);
$append_to_url = "&host=$host";
if (!empty($month)) $append_to_url .= "&month=$month";
if (!empty($year)) $append_to_url .= "&year=$year";
$view = preg_replace('/\?output=\.([A-Za-z0-9]+)\.html/','?output=\1'.$append_to_url, $view);
echo $view;
?>