Remote file contains actual operation

This is my first attempt to solve problems with remote file inclusion , I didn't expect to succeed

First , Upload a Trojan horse text on the server
 

Old rules ,.user.ini Get the documents up , Point to 1.txt

1.txt It directly contains the address of the Trojan text file uploaded at the beginning

Then you can have a happy RCE 了

in addition , Another mouth , If the decimal point is filtered , In fact, we can use ip Address transfer 10 Hexadecimal remote file contains