vbulletin attachments folder

any advice on finding the attachment folder on vbulletin ? 3.x
or a good keywords list so i can write a script that does the search

where the link of the vbulletin site ?

hahah you really dont need it to help me, i was asking for dictionary :)
ps. attachments wasnt a public folder(web accessible). it was a level below htdocs which made it impossible to enter that way also the name of attachment folder was 'files' :)

---

any advice on using shell from php either a bypass of php.ini or smth... here are the banned functions
disable_functions dl,exec,passthru,shell_exec,system,proc_open,popen,curl_multi_exec,parse_ini_file,show_source
ps. also need to escalate privileges but i will make it work once i manage to use shell