Passing the malicious code as an image largely relies on how does the targeted website check file uploads. If the website is checking the extension only, so it's looking for
.jpg in your file name, a simple bypass is
.jpg.php file, for instance. If the website is checking headers only, you make sure your PHP script is throwing headers that make it appear as if it was an image file. You wanna do a google search for "mask php as jpg" or "php shell jpg" for more information.
As for windows, not much too it, there's a few still working ways, but you'll have a semi-hard time getting your target to open the files. For example, you can change your .exe file to a .jpg file and create another shortcut file in the same folder. As target for the shortcut, you'd put
C:WINDOWSsystem32cmd.exe /c whateverexeyourenamed.jpg. Clicking the shortuct would, in turn, execute the
.jpg file as
.exe, however, this method is pretty ancient and my grandma, if she were alive, would be able to see it.
Stuff to check out (type it in google):
- File upload vulnerabilities PHP
- XSS attacks
- Man in the middle attack
Sorry if I missed your questions, but this is the best answer I can give you considering your question. If you're looking for something specific, you might want to highlight it.