Recover the flag.
This is an intentionally vulnerable PHP2Shell challenge running WordPress on PHP 8.4.26 with Apache mod_php. The target is php.bugbountymasterclass.com.
The flag is inside the application container at /challenge/flag.txt, outside the web root. This lab contains synthetic data and no cryptocurrency or monetary prize.
Scope and rules
Only this challenge hostname and its application container are in scope. Other Bug Bounty Masterclass services, the host operating system, cloud account and neighboring infrastructure are excluded. Do not scan or attack third parties, mine cryptocurrency, send spam, establish persistence or intentionally deny service.
Requests and server errors are logged for security research. Do not submit personal information or real credentials. The environment may be reset.