Arbitrary shell commands can be created by using only punctuation in a service that filters all characters except for punctuation.

Mirror here: https://nusgreyhats.org/write-ups/hitbgsecquals2018-readfile/