The attacker reads the uploaded picture Trojan through the vulnerability interface, and then writes to the website root directory to get the webshell.