(Oct 30, 2025 05:39 AM)aloraveraso Wrote:  Hello, I've managed to infiltrate the admin panels and I'm trying to upload a shell, but it only accepts files with the extensions png, jpg, and pdf. I absolutely cannot upload a file with the php extension.

The account I accessed is the most privileged one; I have access to everything and can do anything. However, the casino infrastructure provider has implemented a series of security measures, and I cannot successfully inject the shell.

If we can accomplish this together... if we manage to breach the server, there are at least 5,000 online betting websites hosted inside. We can empty all of their crypto accounts and steal their data.

ibb.co/w9FTBvj

(Oct 30, 2025 05:39 AM)aloraveraso Wrote:  Hello, I've managed to infiltrate the admin panels and I'm trying to upload a shell, but it only accepts files with the extensions png, jpg, and pdf. I absolutely cannot upload a file with the php extension.

The account I accessed is the most privileged one; I have access to everything and can do anything. However, the casino infrastructure provider has implemented a series of security measures, and I cannot successfully inject the shell.

If we can accomplish this together... if we manage to breach the server, there are at least 5,000 online betting websites hosted inside. We can empty all of their crypto accounts and steal their data.

ibb.co/w9FTBvj

(Oct 30, 2025 09:26 AM)DramaKing Wrote:  I also guarantee you that there are not 5,000 websites hosted on one machine. My guess is a few dozen.

(Oct 30, 2025 11:23 AM)aloraveraso Wrote:  I can provide all the evidence. The provider is BetConstruct infrastructure. It's an infrastructure belonging to Armenia—I specifically targeted them. They are providing illegal black market casino services to many countries. If we can access the server—meaning if we can inject a shell file inside—there are 25,000 active betting sites. Among them, there are 100 very large-volume websites. I was only able to access one of these. The panel I currently have access to has the authorized account for one site. This account has permissions such as transferring money to payment methods and transferring crypto payments. I am trying to upload a shell using this administrator account. They haven't noticed me yet because I haven't stolen any money from the inside. If anyone is confident, I can provide evidence.

(Oct 30, 2025 12:30 PM)DramaKing Wrote:  That must be the mother of all servers. Still, it's not possible for you to map out the physical infrastructure without IaaS access or command execution on the box.

Let's say that these 25,000 websites are all hosted on one single bare-metal server. You have admin-level access to a control panel for one website. It is unthinkable that a Web3 site does not use PHP. There absolutely must be a way to upload a PHP file from that control panel. Being as all the websites are managed by one company, it's unlikely that there would be preventions in place for PHP command execution.