[H4LLuC!N4t!0nS]

SO... lets start off with finding the exploit lol... oh and this is my first post here i tried searching to see if anyone else had posted it but the results didnt show anything lol. okay down to business.

before doing this i would recommend using a proxy

step one... type in this simple google dork.

inurlpaw2/dialogs

you should see results like so if you typed it right :



step 2... find the website of your choice...

step 3 now you see the URL you have? okay where it says /spaw2/dialogs/ and so forth delete that and add this in:
spaw2/dialogs/dialog.php?module=spawfm&dialog=spawfm&theme=spaw2&lang=es&charset=&scid=cf73b58bb51c52235494da752d98cac9&type=files

you should come to a page like this:


so then at the top of the website your at go to where it says images in the drop down box and change it to say files.

step 4 heres where things start to get fun now we upload a shell. you can use any shell you want i use c99 personally but its up to you.

what ive figured out is that most of the time the website wont take .php files so youll have to make it like .phtml sometimes, or php3 or what not lol and sometimes it will take it if you make the name c99.jpg.php...... lol

step 5 after you've successfully uploaded your shell you will be brought back to the file manager page. now what you have to do is click on the file you uploaded and to the right, click download file... should bring you to your shell...

step 6 navigate thru their files and find index.html delete it and upload your own....

step 7 delete all logs

step 8 go their homepage to see if you did the trick...

step 9 have a good day like a sir....

[Quentin™]

Nice man, great work I hope to see more to come from you.

[HrDe]

nice start up, bookmark , see then tell u.

[4don4i]

nice tutorial man keep it up..