[Stolidis]

Hello all friends,

Well first of all...don't flame me if this has already been answered..I tried search but couldn't find any info. I am really new to deface thing (not new to IT).

Facts:
a) I have already find a website with SQLi exploit. (so OK)
b) I have found 3 random shell (c99.php, GYNshell.php and TeachEr.php). I don't know if these are good for my job.
c) I have already found a way to upload a file, since the site is using kcfinder !! But my problem is that I can only upload jpg and not php files!!

So when I am trying to run the jpg I have the following IMAGE! I guess that I have to rename the file from jpg to php.

I tried with "tamper data" mode but didn't work (it says Denied file extension). I tried with Live HTTP headers but I had the same results. I tried to rename the file but of course again the same.

What else I have to do in order to run the shell as php??

Sorry if I have understand something incorrect and I am saying bullshits :)

[Cathal]

If the server tries to check the image dimensions as verification, then renaming won't do shit - its still not an image.

This method is incredibly easy to patch, so don't expect it to work on even 2% of sites.

[zork123]

you can actually bypass it by using another various method if you have access to admin account you could probably use xss malicious execution

[Stolidis]

OMG ... it worked !!!! :D

After many attempts I found an exploit with the extension and I upload the shell :)

That is of course good news and I am more lucky!! With this shell as I saw, I have access to the whole hard disk of the company, so I can deface up to 50 websites!! But I think the proper thing is not to deface everything but to upload a shell.php and make the server a bot for flooding and Dos !!

So I upload the shell (a random one) what to do now??
btw: Is there any reliable shell for uploading/downloading/renaming files??

Thanks.