**tl;dr**

+ Bypass nginx's DENY ALL using `SCRIPT_NAME`
+ Calculate key_id uploading `flag.txt.enc`
+ Leak the key and decrypt `flag.txt.enc`

Original writeup (https://blog.bi0s.in/2021/09/14/Web/CSAW'21-Gatekeeping/).