How it went

1. 0
   nmap

   An nmap scan shows the haxtables conversion web app.

2. 1
   file:// read

   The API's file_url parameter accepts file://, turning it into a local file read.

3. 2
   git dump

   That read dumps the site's .git repo, exposing an action_handler.php endpoint and an image subdomain.

4. 3
   filter chain

   The handler's include, driven through a PHP filter chain, executes code as www-data for the user flag.

5. 4
   svc

   A git-commit helper runnable as svc is abused via git attribute filters to get a shell as svc.

6. 5
   systemd service

   svc can manage systemd; a oneshot service runs a reverse shell as root.