[frede]

How did he get the php shell started after uploading it attached to a ticket? I did not get this step.

[curveship]

The server-side upload code let him put it somewhere where PHP was enabled. So he "started" it by just going to its URL.