[aloraveraso]

Hello, I've managed to infiltrate the admin panels and I'm trying to upload a shell, but it only accepts files with the extensions png, jpg, and pdf. I absolutely cannot upload a file with the php extension.

The account I accessed is the most privileged one; I have access to everything and can do anything. However, the casino infrastructure provider has implemented a series of security measures, and I cannot successfully inject the shell.

If we can accomplish this together... if we manage to breach the server, there are at least 5,000 online betting websites hosted inside. We can empty all of their crypto accounts and steal their data.

ibb.co/w9FTBvj

[▄︻デ══━一一一一━]

Hello, I've managed to infiltrate the admin panels and I'm trying to upload a shell, but it only accepts files with the extensions png, jpg, and pdf. I absolutely cannot upload a file with the php extension.

The account I accessed is the most privileged one; I have access to everything and can do anything. However, the casino infrastructure provider has implemented a series of security measures, and I cannot successfully inject the shell.

If we can accomplish this together... if we manage to breach the server, there are at least 5,000 online betting websites hosted inside. We can empty all of their crypto accounts and steal their data.

ibb.co/w9FTBvj

DM me with more info if this is genuine.

[DramaKing]

Hello, I've managed to infiltrate the admin panels and I'm trying to upload a shell, but it only accepts files with the extensions png, jpg, and pdf. I absolutely cannot upload a file with the php extension.

The account I accessed is the most privileged one; I have access to everything and can do anything. However, the casino infrastructure provider has implemented a series of security measures, and I cannot successfully inject the shell.

If we can accomplish this together... if we manage to breach the server, there are at least 5,000 online betting websites hosted inside. We can empty all of their crypto accounts and steal their data.

ibb.co/w9FTBvj

If you can't upload a php file, then you do not have admin access. Good luck with the jail time.

I also guarantee you that there are not 5,000 websites hosted on one machine. My guess is a few dozen.

[Dystortion]

I also guarantee you that there are not 5,000 websites hosted on one machine. My guess is a few dozen.

Or mine... being just the one

[aloraveraso]

I can provide all the evidence. The provider is BetConstruct infrastructure. It's an infrastructure belonging to Armenia—I specifically targeted them. They are providing illegal black market casino services to many countries. If we can access the server—meaning if we can inject a shell file inside—there are 25,000 active betting sites. Among them, there are 100 very large-volume websites. I was only able to access one of these. The panel I currently have access to has the authorized account for one site. This account has permissions such as transferring money to payment methods and transferring crypto payments. I am trying to upload a shell using this administrator account. They haven't noticed me yet because I haven't stolen any money from the inside. If anyone is confident, I can provide evidence.

[DramaKing]

I can provide all the evidence. The provider is BetConstruct infrastructure. It's an infrastructure belonging to Armenia—I specifically targeted them. They are providing illegal black market casino services to many countries. If we can access the server—meaning if we can inject a shell file inside—there are 25,000 active betting sites. Among them, there are 100 very large-volume websites. I was only able to access one of these. The panel I currently have access to has the authorized account for one site. This account has permissions such as transferring money to payment methods and transferring crypto payments. I am trying to upload a shell using this administrator account. They haven't noticed me yet because I haven't stolen any money from the inside. If anyone is confident, I can provide evidence.

That must be the mother of all servers. Still, it's not possible for you to map out the physical infrastructure without IaaS access or command execution on the box.

Let's say that these 25,000 websites are all hosted on one single bare-metal server. You have admin-level access to a control panel for one website. It is unthinkable that a Web3 site does not use PHP. There absolutely must be a way to upload a PHP file from that control panel. Being as all the websites are managed by one company, it's unlikely that there would be preventions in place for PHP command execution.

[RITARI]

That must be the mother of all servers. Still, it's not possible for you to map out the physical infrastructure without IaaS access or command execution on the box.

Let's say that these 25,000 websites are all hosted on one single bare-metal server. You have admin-level access to a control panel for one website. It is unthinkable that a Web3 site does not use PHP. There absolutely must be a way to upload a PHP file from that control panel. Being as all the websites are managed by one company, it's unlikely that there would be preventions in place for PHP command execution.

'Mother of all servers' is crazy work! xD

[DramaKing]

I figured it out. OP can't upload arbitrary files because he didn't compromise a cPanel or similar. Looking at the screenshot, it appears to be a website creation framework or builder. This company is too smart to let just anyone run unvetted code on their infrastructure.

AI Quote:
You said:
Identify the web control panel from this screenshot: https://i.ibb.co/0gRkmwv/hoooo.jpg.
ChatGPT said:

Most likely the SOFTSWISS Game Aggregator / SOFTSWISS back-office (client back office).

Why I think so: the screenshot shows a “Report by Provider” table with providers (Pragmatic Play, BetConstruct, Spinomenal, etc.) and that exact report name appears in SOFTSWISS back-office documentation and product screenshots for their Game Aggregator. The visual layout (provider list, export buttons, sidebar icons and a “switch to new version” badge) also matches SOFTSWISS-style back-office UI.

If you want, I can search for an exact matching screenshot or try to identify server headers/branding from the site where that image is hosted — tell me which you'd prefer.
You said:
Explain what SOFTSWISS does.
ChatGPT said:

SOFTSWISS is a large technology company that provides turnkey software solutions for the online gambling industry — mainly casinos, sportsbooks, and iGaming platforms.

Here’s a breakdown of what they do:
🧩 1. Online Casino Platform

A full backend system for running an online casino:

Player accounts, wallets, KYC, AML tools

Game management and content integration

Payment processing (multi-currency + crypto)

Reporting and admin dashboards

It’s often sold as a “white label” solution, meaning clients can launch their own branded casino using SOFTSWISS’s infrastructure.
🎰 2. Game Aggregator

A centralized system that connects hundreds of third-party game providers (like Pragmatic Play, NetEnt, etc.) through a single API.

Casinos integrate one API to access thousands of games

Handles all transactions, currencies, and player session management

Provides analytics and reports (like the one shown in your screenshot)

💰 3. Sportsbook

A modular betting platform for sports and esports:

Odds feeds, event management

Risk management and trading tools

Customizable frontend and multi-brand support

🪙 4. Crypto Casino Solutions

SOFTSWISS was one of the first iGaming tech firms to support Bitcoin casinos, offering systems that handle crypto payments and blockchain integrations.
🧠 5. Affiliate & Marketing Tools

Affiliate management system (for tracking referrals and commissions)

Player retention and bonus management tools

🌍 6. Managed Services

They also provide operational support — player support, anti-fraud monitoring, compliance, etc., for clients who prefer a “hands-off” approach.

In short:
SOFTSWISS is like the “engine room” behind many online casinos and betting sites. It doesn’t typically face players directly but powers and manages the backend systems that licensed operators use.

Would you like me to list some of the brands or casinos known to run on SOFTSWISS’s platform?


ChatGPT can make mistakes. Check important info.

[SIM-5693364]

aloraveraso, any news?

[0dayexploit]

interesting

[knxtxx97]

Greetz. Remember clear logs

[MadScientist]

Are you Turkish? Why are they all in TRY (Turkish Lira?), man that currency / Turkish economy had taken a major hit the past few years.

[jajameme]

You need admin access to upload a php file

[salmagamal2021]

not recommended

[Tripple6]

wow this is just crazy, good luck with this