[wargames]

Is there any other method to upload shell apart from tamper data, if jpg uploads are allowed,
shell.jpg.php , shell.jpg;.php isn't working,
did any one tried with gimp editor ?

[dhrubo11]

i tried many times but it's not work ...

[wargames]

yea i did tried like hell lot of times but on most of the sites it won't workout..

[cheatson]

Is there any other method to upload shell apart from tamper data, if jpg uploads are allowed,
shell.jpg.php , shell.jpg;.php isn't working,
did any one tried with gimp editor ?

Uploading shells via image uploaders is pretty low percentage in my experience.

It depends whats catching, whats the error?

To try and bypass all known filters, I just try this these days:

Create an image in paint within the dimensions allowed by the site. Edit it with edjpgcom and enter your shell code into the image header. Upload it using whatever.jpg;.pHp (uppercase H on purpose!). If that doesn't work, try tamper data. If that doesn't work it is most likely guarded by a .htaccess file in the same directory that denies .php execution/upload.

Only way around it is to overwrite the .htaccess file by uploading a .htaccess of your own (php by default overwrites changes so should work unless the serverside checks are set to filter this).

Inside your .htaccess alot of people just add the neccesary lines to allow php files, but what often happens is that there is some other mechanism to prevent the php file running. What you can do is set the .htaccess to treat .htm files as files to be passed to the php processor, that way it kind of tricks it into running the shell as you upload shell.htm (or anyother extension you like that doesnt get filtered), and voila.

add the lines below to get this effect:

AddType application/x-httpd-php .htm .html

AddHandler x-httpd-php .htm .html

If none of that works, then meh 👹

[happyhaxor]

Whoa awesome :/ I need a tut for rooting and attackin IIS 6.0 any one can help ?

[wargames]

Thanks cheatson
yes will try will overwriting .htaccess