Although we still can use passthru() to execute commands but we can not appoint 'config.php' to be inspected.

 

Even though we all know that the flag is hidden under that above file in red staff.

FYI: the wildcard character in Linux is '*' which can represent arbitrary character.

Therefore, we can utilize the wildcard character to contruct the payload that can read every file.