Add shortest solution of lixi_2018

[WangYihang]

22 Bytes

?%E2%81%A3=${${`cu\\rl 0:88\88`}};

not for arbitrary command execution, ssrf to get flag~

[l4wio]

Cool! Actually, prior to releasing the challenge, I already removed curl wget telnet stuff.
But it turns out that busybox can be used.

[WangYihang]

oh, ${{}} is useless

`cu\\rl 0:88\88`;

[WangYihang]

wow, I did not notice that... I just test it in my computer~ thank you for your excellent challenge, pretty cool~

[l4wio]

Glad you liked it! Enjoy other ones ~

[WangYihang]

Oh, I think there was a mistake.. I didn't noticed that the function shell_exec will not print the output of the command... so I was my fault, I think die() or any other functions can print string are necessary;

[l4wio]

Yea, you can check the solutions out, there is one payload which using die(`ssh... got the same idea to yours.