[bankai-hacker]

if it only accepts .jpg, .png you can use a unicode to change the name of you .php file, something like exploitjpg.php to exploitphp.jpg..U+202E RIGHT-TO-LEFT OVERRIDE (RLO), check how it works on google. this will work if the sites uses name variables

[lvc1fxR]

I'm going to be completely honest with you...

1. You are actively confessing to a felony and trying to recruit accomplices for grand larceny on a public forum. LMAO
   
2. The "God Mode" Contradiction:
   
   
   

   The account I accessed is the most privileged one; I have access to everything and can do anything

   I absolutely cannot upload a file with the php extension

   
   These two sentences are mutually exclusive. You are likely staring at a "Content Manager" dashboard while thinking you owned the server.
   
   
3. "The OpSec Disaster"
   You have explicitly named the target (BetConstruct), the location (Armenia), and your intent (stealing crypto).
   BetConstruct is a multi-billion dollar B2B provider. They have dedicated Security Operations Centers (SOC). Posting "I am currently inside your system and stuck on the upload form" is the digital equivalent of robbing a bank and calling the police to ask how to open the safe.
   
   You don't control 25,000 websites. You are hallucinating. If you actually touch any money, you won't be "emptying crypto accounts", you will be generating Interpol Red Notices.
   

Even if you miraculously bypass the extension filter (which is trivial, btw), the directory you are uploading to almost certainly has execution disabled.

Just stop right now and hope you don't get caught is my advice to you.

[Yani]

Try uploading with a zero byte. Pause the POST request, edit the name of your file to something like shell.php%00.jpg

It has worked for me in the past.

[diablospartan]

My friend dont want to scare you but this its a very dangerous thing to do for your safety

If you get caught be prepared to spend some years in jail

[KyleTheXyle]

Try uploading with a zero byte. Pause the POST request, edit the name of your file to something like shell.php%00.jpg

It has worked for me in the past.

You have experience in this field? Give me pm on telegram pls

[Leighton]

many have been there long before you and its not admin

[Hackers]

Let's say that these 25,000 websites are all hosted on one single bare-metal server.

I think OP is saying that they have found a vuln w/ the underlying software which is also installed on thousands of other servers. I don't think they are claiming that 25K exist in 1 place, only that if they can make progress on this vuln somehow then there are 24,999+ other targets for them. That's how I interpreted it anyways.

OP, if all you can do is upload pdf, png, or similar then you would need to rely on the software having another bug. For example if they don't sanitize file name, or if there are manipulations with mime type, POST/FILE options, params, PDF handling, null bytes, or other possible problems. As others have already said, your chance of success is slim, you may have an admin session but not high perms, and you are doing something that you should not do to begin with. Whether you are honeypotted or not, you should probably not go for online casinos because 1) the law, and 2) not every casino follows the law. Be careful.

[R5N3T]

wow is good, can u teach me how to hacking website ?

[Chinese21]

Do you have the ability to hack into a Chinese illegal lottery website?

[Dotexe]

hint:

use burpsuite

intercept request after click on upload

edit

carry on forward the request, it should work

Why do you bump a deadass post ? OP is either in jail rn or decided to quit that nonsense operation

[Chinese21]

what’s up ,let’s collaborate

[vetbesim]

if you can edit pages or make new ones try put some php into them and see if it does any good.

[TonyMontana026]

Hello, I've managed to infiltrate the admin panels and I'm trying to upload a shell, but it only accepts files with the extensions png, jpg, and pdf. I absolutely cannot upload a file with the php extension.

The account I accessed is the most privileged one; I have access to everything and can do anything. However, the casino infrastructure provider has implemented a series of security measures, and I cannot successfully inject the shell.

If we can accomplish this together... if we manage to breach the server, there are at least 5,000 online betting websites hosted inside. We can empty all of their crypto accounts and steal their data.

ibb.co/w9FTBvj

I once wrote an article about this; the site's file upload verification is very straightforward. It only checks the first two hexadecimal values, and the last two are checked for PNG and JPG files. You need to place the PHP code in the middle of the file (PNG or JPG).

[cdev]

.svg if the server can accept it
try modifying it with Burp Suite
use a null byte, etc
did you try that?

[dusheng]

I can provide all the evidence. The provider is BetConstruct infrastructure. It's an infrastructure belonging to Armenia—I specifically targeted them. They are providing illegal black market casino services to many countries. If we can access the server—meaning if we can inject a shell file inside—there are 25,000 active betting sites. Among them, there are 100 very large-volume websites. I was only able to access one of these. The panel I currently have access to has the authorized account for one site. This account has permissions such as transferring money to payment methods and transferring crypto payments. I am trying to upload a shell using this administrator account. They haven't noticed me yet because I haven't stolen any money from the inside. If anyone is confident, I can provide evidence.

Hello, I think we can cooperate. How can I contact you?