An avatar that runs commands
A profile-picture upload accepted a .php file. Find the shell on disk, then use the access log to see who called it and which command ran first.
Briefing
The community forum on forum-01 lets members upload an avatar to /uploads. A member reported a broken image on another profile.
Search the web root for PHP that passes request input to system() or similar functions, then match the file name to the access log.
forum-01 · Web server logs
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.