You must upload webshell and cat
/flag