1) Create account2) Decode PHPSESSID cookie3) Change "approved" to true and rencode4) Upload PNG image containing PHP shell5) Retrieve the flag via webshell
Full walkthrough: https://www.youtube.com/watch?v=JJD45W-C9mQ&t=326s