Tags: web rce php 

Rating: 5.0

**TL;DR**: `system("../flag");`

Else check the following links to read the full write-up.

* [Quick way](https://rawsec.ml/en/DefCon-2018-Quals-write-up/#quick-way)
* [Longer way](https://rawsec.ml/en/DefCon-2018-Quals-write-up/#longer-way)
* [Bonus](https://rawsec.ml/en/DefCon-2018-Quals-write-up/#bonus)