A PHP 7.1 site with lfi.php (a local file inclusion) and phpinfo.php: phpinfo() prints the temporary name of a file uploaded with the request, so a race includes that file before PHP deletes it and runs its code.
Not startedDockercommit 3bf08fax86_64 · aarch64Secret
Turn the LFI into code execution through phpinfo() and get a shell.
The brief for this lab lives in its repository.