[racerx105]

Hello All,

I am brand new to this website. I am web developer and a member of Black Hat World and they told me you guys rock here and can help with my problem.

Well I have designed and developed and open cart website for a client. I do the normal half up front and half on completion.
Well he paid with paypal for $1000 and waited until I completed the site. Now disputed a charge for the first $1000 and is making up excuses about his accounting department had to do the charge back and is going to take two weeks to pay me again. Not even telling me he is going to pay the final payment. I have waited 3 weeks after excuses of not paying the final then finding out he is taking back his other payment and now I have to dispute.

I think he has another web designer or something. As they changed the password to ftp and hosting so I do not have access.
I installed before he blocked my access a flash uploader to still have access to his index.php which I took down, but it doesnt have the correct permissions to get into other folders.
So seeing if you guys can help out? Or give me some suggestions of anything I can do. I dont think I will get back any of my money which was a total of $2200. But would like to do something for him screwing me over.

Thank You,
Racerx105

[Microrobot]

What is email, what is his website. If we know, we can exploit through, and deface it to the point he will pay you, or RAT his pc.

[racerx105]

http://carltonstraining.com

I have removed his index.php and replaced with index.html with black screen.

Other than that I dont know what else to do.

[Microrobot]

Ok, his email is [email protected]
His phone number is 888-239-5003
His name is: Jim Case

[racerx105]

Yes exactly and his website is open cart 1.4.9.5

[Microrobot]

He also owns a store too. This website is for his store.

[racerx105]

He acts like he has a huge company and that his boss makes all the decisions. How do you know he has a store? Pretty sure he is the owner then and he is lying to me. Anything we can do?

[angrybrit]

He acts like he has a huge company and that his boss makes all the decisions. How do you know he has a store? Pretty sure he is the owner then and he is lying to me. Anything we can do?

Can you upload a php file if so I would upload a shell and root the server, get rid of your scripts and all, report the root to the webhosting and leave him with an empty website...

[racerx105]

As the flash uploader it does not upload php files. Does upload every other file type though. As for the know how to do any of the other stuff I am just learning all this. If you guys know how to take down this website complete it would help a bunch.

[Microrobot]

Address for his shop: Carlton''s Training Solution
11693 San Vicente Blvd
Los Angeles, California 90049
United States
🤝

[racerx105]

Looked it up on Google Maps and not a real office building or store. Just using that for his website I think. Anyways anyway to upload php files or something that can take down his site through open cart?

[Real Madrid]

You could try this tutorial:

https://hackforums.net/showthread.php?tid=2105957

[racerx105]

Great Tutorial looks like it works for a lot of stuff in the future. Unfortunately I only still have access via a flash uploader I have in his website he doesnt know about. But it wont let me upload php files and also wont let me change the file names. Any other suggestions since I still have access any he doesnt know about it?

[Sky]

Great Tutorial looks like it works for a lot of stuff in the future. Unfortunately I only still have access via a flash uploader I have in his website he doesnt know about. But it wont let me upload php files and also wont let me change the file names. Any other suggestions since I still have access any he doesnt know about it?

You said the up-loader allows other file type's but not PHP? Try uploading a shell.php.jpg and replay it via Live HTTP Headers?

~Arcane 🤝

[racerx105]

YouBou thanks a lot this hack is a great tutorial myself and my other developer are trying to see how we can take down his website. So I still have access to the flash uploader and also put the phtml file in there now so have access to upload php files. But he is on a plesk dedicated server and it wont allow me to get into the catalog folder because of permissions. At this point I know Im not getting back. So I just want to take down the portion of what I did and not mess with his other stuff in there for legal reasons? Anybody help me or give me some guidance. My developer and I are interested in learning this if this ever happens again.