Obviously, it's something about shell execution and we just only use 'system'. 'exec', 'highlight' those three functions to execute linux shell command.

 

We find a config.php file under this directory. 

Then try to get the informaion in it. 

 

Nothing returns, so maybe 'cat' is filtered, we use 'tac' to instead. 

 

It works and hints us the flag is in config.php.