https://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-ex...

Once you can run any command, you start passing in whatever commands you want.