File read / path traversal in favicon.php -> get source of helpers.php (contains path of flag) -> request flag from webserver.

https://advancedpersistentjest.com/2018/03/04/writeup-el33t-articles-hub-pragyan-ctf/

Original writeup (https://advancedpersistentjest.com/2018/03/04/writeup-el33t-articles-hub-pragyan-ctf/).