> The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.

Exactly. This server is exploitable, but not with an off-the-shelf PHP2Shell PoC someone found on GitHub. The PHP2Shell exploit would need adjustment to the specific application configuration, and to that end, you’ve come to the same conclusion I was implying.

The easiest way is to use PHP2Shell _with_ another unknown vulnerability in the stack, such as nginx etc…

The challenge is trivial to those who know better than to even try. You cannot succeed at it without giving away far more than you could ever possibly hope to gain.

Of course, there’s always the wildcard of someone throwing away the nginx 0-day just to be funny.